Extracted

• • Target

    25733f053e6f0fdedbc50db5ec4d02bf_JaffaCakes118

  • Size

    748KB

  • MD5

    25733f053e6f0fdedbc50db5ec4d02bf

  • SHA1

    c21d094e8a130bc544b0bb64997c85bdaf30f368

  • SHA256

    d647cff74210ee62da7c701ab7b090998d76df346658f83c23b40964c6687c11

  • SHA512

    990b081f8279315c73f7efa8f17ee5a2359bb373c9b31d0466aaa9b337a4f7342a66c7f52a4997ab79c32aeb00a7af2532c17a31c520168f1471ecb157e272aa

  • SSDEEP

    12288:ms/LbVe4RrOwnxAYMJxn7XVNBbOJB+HL3ENZ2O7RK6NPJppk:RfVe8rOXL7DzHLkdNPJppk

  Score

  10^/10

  darkcometfbpkrdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2