Extracted

• • Target

    f4cfc34ef310c90c671e932798ba9d01_JaffaCakes118

  • Size

    797KB

  • MD5

    f4cfc34ef310c90c671e932798ba9d01

  • SHA1

    40bc03e2b1194c405d6229ab0357acdcba856e94

  • SHA256

    aedcb08e50583141abd147a6c3c9060346bc34107f17550ad80552ea7b6e19f0

  • SHA512

    c9aa418e87c02f0e6fba600130bb06b843d11840229bb60f879131cf7770e303491b1a69fe35b2b6399fef0de1a01b970b1ee604332bd71ccebd99d7bc09fb89

  • SSDEEP

    12288:44MkEs4X/MQTjKX1FmDUfDb1W+pV/sudn9z4TH6WO3NQ6n7vg9LbSpu2oRPFOWyc:4VT2mDU7b1WgRd90TH6WOdnzg9L3M

  Score

  10^/10

  darkcometlatentbotdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2