Extracted

Extracted

• • Target

    JaffaCakes118_2dd0d87ca027e8a8e93be1a9d0af4603

  • Size

    1.2MB

  • MD5

    2dd0d87ca027e8a8e93be1a9d0af4603

  • SHA1

    dda78e8d6db1a6f31c0d2b1ec87bbebcb240e526

  • SHA256

    c2edf8e47d828c3a22a5323d199239f5df8b0aaf3db7f2eb2ced2fe982eb3d11

  • SHA512

    3788df6fabde33fe7361c65021d8ea660c5d585a1a8723a9fcaa9b2e159dd1aede97995f57177b122186190ae8a09fd66d51377482a462224db9652246ff8b78

  • SSDEEP

    24576:XUgHStqsjZRxWCxvyxP8D/jL637LgynjnS+Q:XUyCdD4WZD/X6vNnV

  Score

  10^/10

  darkcometlatentbotguest16_mindefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2