Extracted

Extracted

Extracted

• • Target

    JaffaCakes118_79177807ca02ab91118156ed7da95cb1

  • Size

    2.3MB

  • MD5

    79177807ca02ab91118156ed7da95cb1

  • SHA1

    03eeaca2b6f69044fbec25324ac184b44a135e59

  • SHA256

    21a8bcc1b3175e1388f76c38f9c9ca55815989f9d8cb81139ea9033b467dbbf8

  • SHA512

    0bacdc44c2706ece383b09f4f52a69ad943235a9bc520711cfe919d8804d14121fb14fcc92318e8f7e314678b1225e4d0faf66cfc8e04267509339e8bfdc22d8

  • SSDEEP

    49152:5GNXcWomAEPyHL2Bt0CE5T5b1bqqKGbo+ik/MdXlLIbGkssf+qI:5GNsZmAEPvoCGT1lx/MdVLwGfslI

  Score

  10^/10

  darkcometlatentbotfortune bypassdefense_evasiondiscoverypersistenceratspywarestealertrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2