Extracted

Extracted

• • Target

    3a3c0aa36c23d1ce82b90aa8a4826fc8_JaffaCakes118

  • Size

    1.0MB

  • MD5

    3a3c0aa36c23d1ce82b90aa8a4826fc8

  • SHA1

    0b1f693df6ff30fdeb04af20c2ec681cb3976a94

  • SHA256

    b410782c26bec5ad3281f196e9ff3546be1f8394b9eadd81a7de5758286f0a36

  • SHA512

    92823824ed526187d8872aab92e6cafaba8b55250b94c4b946baf75f216e363c6f0d383ac402441583580df481801696c56961714f8068c13c8643fe1419ca40

  • SSDEEP

    24576:z8Evfhntxi7mrFhQ8ehkIRxgt4GZtZmWS:44txi7mr4/dRDGZLLS

  Score

  10^/10

  darkcometlatentbotguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2