Extracted

• • Target

    0d7fdb9b4f8fd7dad8bed13640839d24_JaffaCakes118

  • Size

    1.9MB

  • MD5

    0d7fdb9b4f8fd7dad8bed13640839d24

  • SHA1

    ec162c23c310dd27f69195ba9711f67f60dbc36a

  • SHA256

    77e6549f91e50d0fa9a46300823eee0c5d26e0e887586972812e2103b8add68c

  • SHA512

    4becd8ac3a536548fd777c3ed745890d0cfffa6328fbeaf1cdaed3a608acd8cc84bfa3838761748db85b847769041ebb1ade6798dafe38fc09765051dbb993a1

  • SSDEEP

    49152:1Vjpl2+DwQ/bU/jCxmiya/EjErEFcZYxiHJKp:jjL2APxrya/EjEExiHk

  Score

  10^/10

  darkcometpcevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2