Extracted

Extracted

• • Target

    ea18fe0423c75ef98ba67ff5007c4ebe_JaffaCakes118

  • Size

    1.1MB

  • MD5

    ea18fe0423c75ef98ba67ff5007c4ebe

  • SHA1

    639e898a3bd5ecd30d78f7c7e8893e79229bdfcf

  • SHA256

    6a22a4de220e4e271f2b9136ce963d1eb86fb2545f83f167de05dea3dca0904f

  • SHA512

    2c59ba02c4c19dfef8fe9bcbf00047484673ce8ef879c69245b303740997816f7c3965bb7c9f79d91a737d917a6f4e4fdef6bc6dc974616f7733a46a7e1e267e

  • SSDEEP

    12288:5eyzrb2QQHxrYttm4Cfxa9ViAzKPDXkU9w4gUKdzKxi+2/AalQLZHf01noDPaswM:XDt4uF4Z/5AZJt2oancdh5kIHR6/XNV

  Score

  10^/10

  darkcometlatentbotguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2