Extracted

• • Target

    e63ac5e07f37c1b181aa02d04743c49d_JaffaCakes118

  • Size

    1.3MB

  • MD5

    e63ac5e07f37c1b181aa02d04743c49d

  • SHA1

    45025e5457cf4883acaf32db083a72cbe91532e0

  • SHA256

    2d54f8acc24d92b01e76b7e588795fcf4c6767d91af149230b2ff0adedc5593b

  • SHA512

    468c9f9f93dd06c457ab135cd7f190c3c0f34030e61add8eb74e176deec68ce07f1dc4884fa94b46ae0520ce3a73f9ca49affc3e5b404d055adaa7355f90971a

  • SSDEEP

    12288:/1jNhRmGWxuIOlYddlH6fQni2CVNQdOFyR78RdIHGD84O+XXdNKUL9LJwDu0cwS7:oOWXa4tr8zIHGD/LoJLb70g/F8i4h

  Score

  10^/10

  darkcometlatentbotdiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2