Extracted

• • Target

    40b4d53e52d6ac2f37aa6540b9258b9d_JaffaCakes118

  • Size

    421KB

  • MD5

    40b4d53e52d6ac2f37aa6540b9258b9d

  • SHA1

    87415fc56d8d87ea631f5161f6584e3e3d338fd1

  • SHA256

    2a8dca5794c095ea67845468a3fd0a8e91a24bf3f0bb5e0ec6c16a6579cc4e90

  • SHA512

    05f5c90c3ea91d4e42accf91ff0a3367f1984bfdcaee43f9288d08f5a749e373161212c580096830231f570bba6220ab060b199a218ca6f90d30195600efa33f

  • SSDEEP

    6144:m9kzClPoAZwmO1wiK8Om6laacRNNFSGpvK2wh1MQGVlC+MBQTnjlUWRlYwLnjECV:kkzClwT6a7tSGpv/wh1NaQ0jlUAtjJ

  Score

  10^/10

  darkcometworkdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2