Extracted

• • Target

    8098b7be7136d88021b5f4df28e1de54_JaffaCakes118

  • Size

    4.2MB

  • MD5

    8098b7be7136d88021b5f4df28e1de54

  • SHA1

    2696649d6ace83daf71b3a130dd557831c3ec2f8

  • SHA256

    c177580c83b028f90e30f1cf1bfb99ff3d6a250d0b8fe007464363eb0ed922b1

  • SHA512

    4a0b675b71f787d27efe6942c23c694e07e874797b93f37322117a83510695b87fb503ceee91c7cb04229fefefcfea73c945d0aa4e3f7c01d0f882794facf9ab

  • SSDEEP

    98304:bd1URGq6q96vM5GofcmjtLhbHPSyb+qSCPrcYxXMdmvkv1:bPURGqxWofcStLh2yllzp4+O1

  Score

  10^/10

  darkcometguest16persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2