Extracted

• • Target

    JaffaCakes118_1696a05c8521b759e70f091b797a6c09

  • Size

    1.8MB

  • MD5

    1696a05c8521b759e70f091b797a6c09

  • SHA1

    2a9eea5fe35adf70f4c79532e42f890589ce40da

  • SHA256

    2d86b9f26c542159b056940e0681f820c6bc9001fea062326ed1d57f18a6f5dd

  • SHA512

    244ae381624437bab341dbeb5e959bd73fc85ee0e2a11a670990ecb1697b42ca7b409ebdc64513d919a51607cb86ceef8efb4096bed90281967b467a4a57d6b6

  • SSDEEP

    24576:V6gmlWIEmRZECDeyvHFUIPUYCthhgfmnFEhgH0WmMl+33VwrAi537TeskP6gJmc:VMEyDd+zM/wMY37Tes2U

  Score

  10^/10

  darkcometisrstealerguest16discoverypersistenceratspywarestealertrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • Isrstealer family

    isrstealer

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2