Extracted

• • Target

    JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0

  • Size

    374KB

  • MD5

    6c9f7afb7c09c420a413b5f7f2c5cdb0

  • SHA1

    bc05b30655eee5f223c9f0d634ba354b8f585486

  • SHA256

    87a862ecd148181c318d98a64f0cb24ae19d1ebcabf379f0d8254181ffb2cd0b

  • SHA512

    c5cd584abd1c3ce3aea2ac52713d46bfa241ad50f1be32e8ca20aee373b7c163aee7797b4a2b53e5ae06f3647331dc95cbb382ceac1f4c9170cce3008c14113f

  • SSDEEP

    6144:HcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37yEAvDNeqQeld94a3ovBa0:HcW7KEZlPzCy37MDN18vV

  Score

  10^/10

  darkcometramnitkazantipbankerdiscoveryevasionpersistenceratspywarestealertrojanupxworm

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2