Extracted

• • Target

    JaffaCakes118_bfe78d863289884c1eb72dd4c17ec33b

  • Size

    1.3MB

  • MD5

    bfe78d863289884c1eb72dd4c17ec33b

  • SHA1

    e004f1d015a7b3259bf1d412f9a01561d2ddc81c

  • SHA256

    ca59df6efbf56fe0a4bdce6782ea7cb03a715e521ee9d1764f03255af0ca1630

  • SHA512

    9ce57085c4f95b6e8237ac50bbd4cba78da8f49bc32620e820ec0a4f93725f69609fe00d8b11c0ad82cbf20effed5919a0aa69db62aacb37c565e89bd8bf3d57

  • SSDEEP

    24576:aV0tD8gqyAHBXP8zcofDuDd0QSZgYpPVbOQE:+0l8TphkhqyXZvPMQE

  Score

  10^/10

  darkcometisrstealeropfercollectiondefense_evasiondiscoverypersistenceratspywarestealertrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • Isrstealer family

    isrstealer

  • Modifies WinLogon for persistence

    persistence

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2