Extracted

Extracted

• • Target

    JaffaCakes118_22417ced93044d377d8c8c791c952090

  • Size

    385KB

  • MD5

    22417ced93044d377d8c8c791c952090

  • SHA1

    0478205a61cff38a6cecf21f5d112956bb36ed49

  • SHA256

    950582ca83f3793e48268be3385be6e1fcbcb35c5377118ca042bd0813e6fd69

  • SHA512

    cc1d546b5dbee96aa07c37cf7c8d73035fdeeab23cf709c17777fd065e4fb256ab1b12d405048221e9af45f56b9fb80157e7b35c46d6bff7cf96a3a208b1d3ba

  • SSDEEP

    12288:NWUtK/gTC7PLxIkjiw+8iG6TEgeM8F/ydYDmj:NWUtK/wWP/jiLQCONWbj

  Score

  10^/10

  darkcometlatentbotguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2