Extracted

Extracted

• • Target

    f1cb4f458ec6743431ca39260b65ffd9_JaffaCakes118

  • Size

    681KB

  • MD5

    f1cb4f458ec6743431ca39260b65ffd9

  • SHA1

    f487309ce0e6e3c9eb09170e9e0d2175faec264c

  • SHA256

    e74fa692f44b7d64fdb05892bdf340eca068e4efe78a39e824f7f476f78e0cc0

  • SHA512

    aee2c794f99897755bae14574e6dd15344ddb5c5bd0a8f7fcd2981b8569f591f0e1e2f7b3b6e21eca71fa23488c9375b7d33ed65e1647090d060781b33c90c9d

  • SSDEEP

    12288:2k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+RA:70QRWoJEfg0oChGdJQbjPbNW5tYeP+G7

  Score

  10^/10

  darkcometlatentbotsultandiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2