Extracted

• • Target

    e39e2d4f842454d0758aee2cde0bbd56_JaffaCakes118

  • Size

    403KB

  • MD5

    e39e2d4f842454d0758aee2cde0bbd56

  • SHA1

    714688591b2f00d11b67d84db1694a0f57aff655

  • SHA256

    d8ff424ea922d6da734ceb5dc319f57ebd892101e96d4a65c2616e4e3f4a0845

  • SHA512

    a60f1d68c6d9a1b4df1cfd166af01130d4b3ae312cd817e75a8d2587365fa81efe7bc60cb24e3118d2f557efd9266ce003b98f1dd48e0f10e3c2fa854f196813

  • SSDEEP

    12288:tJIIhII+V+gGc5mBpcOKzDCW50O8kR8CswbOha5:8YPRpcJCW78EKwbya5

  Score

  10^/10

  darkcometmodiloaderguest16discoveryevasionrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2