Extracted

• • Target

    2e3304da8d9a54d3a7fb228e19db8f72_JaffaCakes118

  • Size

    230KB

  • MD5

    2e3304da8d9a54d3a7fb228e19db8f72

  • SHA1

    91ca6dc5965c5baae9683968d59ad668ff426787

  • SHA256

    dbdbee96e293e811fd197aaaa978b11d4c4752e5adad83cd977c835f349d65ef

  • SHA512

    65d785b294cb4e67e35d546da62db65a7f2e98650e681b31ee4ba0c3e7ad13a3c5fb437262d7607b10f720ba4186ba8e20e2bf1a74769764c27d6b423938a75c

  • SSDEEP

    6144:V0eLNExQ3gmAG2j7580UJpvNH4TiXfBhkMgDVUqdgtcpgoS:VUQ4GA5sp+qBhi1HgoS

  Score

  10^/10

  darkcometnasitdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2