Extracted

Extracted

• • Target

    581991d038f83e174c3d331f7953b09f_JaffaCakes118

  • Size

    1.2MB

  • MD5

    581991d038f83e174c3d331f7953b09f

  • SHA1

    a11290cb527b5afd624db4de8640ce68725e0a1f

  • SHA256

    a4338668c0f1f599d8f3e64b739bb3a03ff79fc743df4e7326eebb3db19876a0

  • SHA512

    c4e9c611647158b4497b6647e7f6fe6c675c0618f193c37cd6c9123ab316fb0770763f7474829bc2e4c712245986bd4cd37964a78a62b63c1f0589873d21ef13

  • SSDEEP

    24576:FFjUKMF5IVOZtZ6sz5ilSB6i9AWJltHZTYtCK/cRgOnmq9g6FFfEhq:FFjC5IVOzNZB6i9AyHZTecOU7m6TME

  Score

  10^/10

  darkcometlatentbotguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2