Extracted

• • Target

    6f43b537783e3773add26914099c217d_JaffaCakes118

  • Size

    1.6MB

  • MD5

    6f43b537783e3773add26914099c217d

  • SHA1

    50c8407245bc0c90189c27daa2246970a66156cb

  • SHA256

    ca70007968fb2447d9d568b5c0140513784f7307def356186939729b07ac43a2

  • SHA512

    f8130d71907f35938b0990598e469e044714aea0a5c2502cdc1a7dfeefbf03b112bb3ee8144efb0f02098727f77d8876c608a25f9c06ab2e5cb5251571f19a1c

  • SSDEEP

    24576:BWScgdxiL5Ef37aV0tWaigK+uEVLVCk0dt+YJea+oZbbn2V1DjFLfyuO2+U:BwcxoYraMFigKbUVCkm++egbnUtLR

  Score

  10^/10

  darkcomettoontown membership generatordiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2