Extracted

Extracted

• • Target

    JaffaCakes118_7ec89d69d9b1271067956899ecd925a4

  • Size

    1.1MB

  • MD5

    7ec89d69d9b1271067956899ecd925a4

  • SHA1

    cc52fa1052827feaf8b2d9ee288cb8abcc269b0c

  • SHA256

    bc28436fe3bd18ea08991259531d0ea786009cc4320449f1c2af8d134d1b4ef0

  • SHA512

    3898b8d71c06d859927e20cd962cf4eddd544d85ea5829bf14ed8ecf5ca9b2ef70a9da78095dfc262aa5c33ea6b41e5e0c56bc6557232a4d699c9f0a90a1100d

  • SSDEEP

    24576:syg9rCyaSen+WgSQ6JLZCaI9KRnenuc44l:xg9mznmSQ6JLZCaUkA

  Score

  10^/10

  darkcometlatentbotcrypteddiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2