Extracted

Extracted

• • Target

    d604a165826a3df124f663479b0607b5_JaffaCakes118

  • Size

    748KB

  • MD5

    d604a165826a3df124f663479b0607b5

  • SHA1

    f3afcb70f500c2dcdb2fc0edd6869c31b43dc792

  • SHA256

    1001065dcc00ff8d14c2166940a2936b1ff78c3cffa17eb75b502a2a9a932a2c

  • SHA512

    00f0c02b13fd7806cd8664b5278b3a21785f8dd8871655d7af24794c46a0c39514648d25f33d1b33b7967dd3bec0882051205d26decc12a10f2a6a54589a9ebf

  • SSDEEP

    12288:M5S3h2B5NGhJIrb6RgGKKmsDkAuTVGH6Txqa0m6vo:iyhRyrb6SGKWuRGHHad6w

  Score

  10^/10

  darkcometlatentbotdongaadiscoverypersistenceratspywarestealertrojanupxisrstealer

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • Isrstealer family

    isrstealer

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2