Extracted

• • Target

    70654212388bd1b6dbe96f20bed2b9fd_JaffaCakes118

  • Size

    725KB

  • MD5

    70654212388bd1b6dbe96f20bed2b9fd

  • SHA1

    7a36179f136cb7cab344218060add8cc8442fc70

  • SHA256

    e8e913379cc347386ab9d4e79f0c352ca9523e98cfabf7652f87240abc343ce3

  • SHA512

    dcb83d8c4911798e727e99d6b2d6df3bbcfce72139db5c7eb831f1d89d1703d9f9a2286feae1ae919da97d3d516f1f4cbea30f21e3c3961bc8e16b9018bdf19b

  • SSDEEP

    12288:48UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1r/Gsd:RUKoN0bUxgGa/pfBHDb+y1LG

  Score

  10^/10

  darkcometlatentbotdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2