Extracted

• • Target

    5c0106271bdbd29ee14f145d87caa082_JaffaCakes118

  • Size

    280KB

  • MD5

    5c0106271bdbd29ee14f145d87caa082

  • SHA1

    5e758d47f5fd4c8f6eb2fc1c039bc6d72e6241b9

  • SHA256

    cacddf660daa544ed10b229c985b88e987b611bd5528b4bdb526809901cab5be

  • SHA512

    a2fbb5511cbb31285019e6c0e23a021919026314fb32ba07a8d0318353d74ed5b6c510c7e186464513e56fe3078cc7b8a65c2f3499d104da05d6b915abf2025c

  • SSDEEP

    6144:iwT5O7pJmNB6dLY6dCnnsyZLHoaIyv6ocU/qxDS2xDWb3cwEw4:iP+NULZdCn3TbncU2D7Ab3n4

  Score

  10^/10

  darkcometvictimdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2