Extracted

Extracted

• • Target

    b28d71f5e9a9e74c008f8102923f5d08_JaffaCakes118

  • Size

    1.6MB

  • MD5

    b28d71f5e9a9e74c008f8102923f5d08

  • SHA1

    a7769e1357506e4b66a0048d18b4c8da1df26378

  • SHA256

    b8b714b79cd5de967763d423693fdd4eee57676eab485bbc3a6aaccf5cda0ba1

  • SHA512

    c59c834e03ca30e0cd408082397d5b715ab5459067809aa5e44c2030e80b6d63c7a605eb96ad78c4dd3cc1abadeef0f70fb80b5c43b6b69f4ee428c1efeae4cd

  • SSDEEP

    24576:saHMv6CorjqnyC8ulDrAZ0P4qgarLj+k3JUiDaiR5RzeJTdK6z:s1vqjdC8YDvP4ParLjrnWiteJTh

  Score

  10^/10

  darkcometlatentbot1discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2