Extracted

Extracted

• • Target

    cb6bde01b9bd96be9e7a3b39601d696d_JaffaCakes118

  • Size

    1.1MB

  • MD5

    cb6bde01b9bd96be9e7a3b39601d696d

  • SHA1

    e873f810351e9fa2e27e89191f1aba02eb14d5de

  • SHA256

    dfd0da819764547d4ec0c70f17b0461416bed3db0be3df399588635db2bf4da0

  • SHA512

    6990b21a3bf984b1e78e1a50ba166d0443cf434364afba981c1783c39ee4560a676433da276bf035ed6d677c93dafb041eada90e9cc518bfe3b36d04ec446ba1

  • SSDEEP

    24576:uKiQgRxWQvVW2f09pNXZGtCjaWN9x7qUlAVbx:uKdgjWQvcTX0tCWWNr7qUlAd

  Score

  10^/10

  darkcometguest16discoveryrattrojanlatentbotevasion

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2