Extracted

• • Target

    461cdeacfa99595adbd61cc33861566d_JaffaCakes118

  • Size

    1.0MB

  • MD5

    461cdeacfa99595adbd61cc33861566d

  • SHA1

    98b03571f2da19742b57b436ee4d70bd3b7f622d

  • SHA256

    bb81c08d7ad157fce394b5bbec82f9809803f1502347cc097b7a689ec4fad8ce

  • SHA512

    e6ce290a30ce7f68145dd63a4f2cc6f00877416805122aa46e853f3ba1bcea565a6cbdfddfcee534e0dd913f3b0d885890d13943980ab7bba3999aee9ae79e93

  • SSDEEP

    24576:aqdhnAVHAJkV38Hk00IltWhi49IhakMbTwSAERhqu6khuXau7P:rhNMMHkQtW1+hAbREuVhu17P

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2