Extracted

• • Target

    00e435496590b9c712d89945b07f6516_JaffaCakes118

  • Size

    678KB

  • MD5

    00e435496590b9c712d89945b07f6516

  • SHA1

    16e228317389dcf11196e75ad4910a46a9d664de

  • SHA256

    eab44c4bf6f2b14afb77c92fe3b509f33d6195312438d399005422982f33cc16

  • SHA512

    46fb5eb6cdf6b3f2a0861ff6d18c15acd17504a6602ff1caa0d8b57e30b1d9a4075791ed64efac6669158fd5514b98c6bdeebe6fa25873e5971634e3fdb33c46

  • SSDEEP

    12288:TJTFIIhIIIuFKEBIYVMgqtYrsSialzYCvhNxVV0Okcb5L:TSE6YmYgbaxH1l

  Score

  10^/10

  darkcometlatentbotdiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2