Extracted

• • Target

    fdacdb5e42a2764ecb7af4feedf8a7de_JaffaCakes118

  • Size

    254KB

  • MD5

    fdacdb5e42a2764ecb7af4feedf8a7de

  • SHA1

    1a4d5c98d6e8ffbdf3b0b71e80632ff5efb9f25c

  • SHA256

    17a2b57aac91aee6d92c8825635f5a42eefe1081b4d89837c3c72c0bed24fb8a

  • SHA512

    05edacea5a42297a735f9c1ed3dd320786d51d9974b96586369e2e750d1cfaa95f8b4659c2dbe7c72e76e5f6cf3afff735ec7e406615793a661d1c7cef59d687

  • SSDEEP

    6144:lcNYS996KFifeVjBpeExgVTFSXFoMc5o3AY4T:lcW7KEZlPowdT

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2