Extracted

Extracted

• • Target

    cf2befaa600d8b558d53321b5dc80847_JaffaCakes118

  • Size

    1.1MB

  • MD5

    cf2befaa600d8b558d53321b5dc80847

  • SHA1

    e3cd5578d27635b977accb9d9db8b101a5fd94c6

  • SHA256

    814b54954d4f4e0a1b8235f9d43b41509d3cb5d2dd48f042756c818dec5c65ea

  • SHA512

    b84cf2c7b80efc2e3e2a6c51d5c8c40ee35f90a55ca1013e9efb6f613df1cfb08e7fc7eb2b863bc625edd5c5ce57fc53db437684492f934e20e2a59ffcf9999e

  • SSDEEP

    12288:ZN2Z70XArBPZpWos0QHbTgaxmH3pEw2Eq2IRlU3ddGXspJDjM21dMYpigb6p4Kuy:Zs4AtPhapwzHXddGXoVOYzA7uN3OrdX

  Score

  10^/10

  darkcometlatentbotguest16discoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2