Extracted

Extracted

• • Target

    f7e46f94490dd52b83ed089ccdbe5357_JaffaCakes118

  • Size

    561KB

  • MD5

    f7e46f94490dd52b83ed089ccdbe5357

  • SHA1

    163ae8daa487c8c3bb144514d64f3971695bb2f6

  • SHA256

    00e4aecf66b5a0d78cbb847faa2a90c13de6766b210bacf0ab45b14527632956

  • SHA512

    840e30bb7bf7d2210b23efa4e8324f5dc35d73dabee0c7f961e1ee52557e0e2b8d784d6e98f818434124991371fdc0fd8ebfed3b0b70c6c914bdd7e019c4eeed

  • SSDEEP

    12288:ZoS493ACIl7vI1kiqHNnyVek/a4AmHNX467pnIORK5GkR7lRPT5lLwEC8G:ZoIjIbgyLC4t5467uOk5GkFT5d6n

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2