Extracted

• • Target

    18469c5b36b124f6af8fb5d4de355d0a_JaffaCakes118

  • Size

    1.1MB

  • MD5

    18469c5b36b124f6af8fb5d4de355d0a

  • SHA1

    674d4492435b6c083830fe53ad262d688138ced0

  • SHA256

    0e29b2f169d75f53e9b0f78844eb987814d280399aeb7dbe6f2da76c462915b5

  • SHA512

    458b80848750320d956bf6723c0a78b9c484244bc56d9051c35fe1ab0568efc3b96e59a19f1f388c0ca904288e508857988eb0622cda1846a615592110dd2f30

  • SSDEEP

    24576:k2O/Gl2/sPdcPDMHHYvsPB3RSVH3NkrUxoXijT7b6P1nB7g6zwm4m53Sb2XCs:W++2H9JRSV6AxoXC7b6PL5kFm53SyXCs

  Score

  10^/10

  darkcometyung thugdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2