Extracted

• • Target

    bb528c3ea8d0f3092ae05bf9826f2535_JaffaCakes118

  • Size

    755KB

  • MD5

    bb528c3ea8d0f3092ae05bf9826f2535

  • SHA1

    08fe7c0a3cfaae422cfb21c171f080ec27c1d276

  • SHA256

    e42c9f7fcb82b48b7ac2e9204f7cde48d434c8465de2096b20f05577ffe95b7c

  • SHA512

    a9640aee50e188e27933ef219a719f14c6eb9a5cad6b0a23e6ad47688c4618c3a090f63c0ab9d028b7c386340ba0d68e8df472cecd34e8321b7aa5d736ddb2ef

  • SSDEEP

    12288:CFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJ1:G3nbWmJVJFwSddIXvfhqbiaxvRxq9

  Score

  10^/10

  darkcometlatentbotdiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2