Extracted

• • Target

    6a44fe87f200b6d088283bcb8a09de60_JaffaCakes118

  • Size

    437KB

  • MD5

    6a44fe87f200b6d088283bcb8a09de60

  • SHA1

    85ee7aead8cdf3188ab557fa3d1646dabbee5cfa

  • SHA256

    a0c67599cbd0895731e75614ab9ac96885eef66f27b917ec9092ea276c9b863e

  • SHA512

    c6ba6f9a3b96135c22393ec65b63a6884150cb1dcaa7373d8b63887f80154d292707ecbb8151535796502e3481dc5d93a31cb2b3510c8fa12e1fe9e30f806851

  • SSDEEP

    12288:XAGAViwM6nkT4EqyV9iUdp3cxsdYponS:Q3guxsmOnS

  Score

  10^/10

  darkcometnewdcdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2