Extracted

• • Target

    203a1e6dfba46d8fa0ee9c61bff1552d_JaffaCakes118

  • Size

    1.2MB

  • MD5

    203a1e6dfba46d8fa0ee9c61bff1552d

  • SHA1

    8a6378edd890d2a4447ad29b50012940496bd2cf

  • SHA256

    10a46ae388ed8008994e9f7ed9ee1c11206ef4572b4c29ed7a03733be48797e6

  • SHA512

    b89c637af3c19a48ec7fe327ac6191854e4d2f8f4be6df724e7a38a95ba4874f90be05040f5a8b108d4cf8378de10001f6341bc92de3288c61554735c302ec12

  • SSDEEP

    24576:mBLdexGREcLFvIrp+P87FFUhkJrwoWylXnUc:mBLd1RfvIrzF6KrwoWylkc

  Score

  10^/10

  darkcometlatentbotdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2