Extracted

• • Target

    7894751afeacdc7317d70902b0aef553_JaffaCakes118

  • Size

    268KB

  • MD5

    7894751afeacdc7317d70902b0aef553

  • SHA1

    5ced79e8a348593eb3a89af9bfc5eea48ce0e750

  • SHA256

    58eeaaa78a65542456268a9bb5a3129e72c504e2e4e1163417f9be321161bc25

  • SHA512

    53f407d9c04a77bd811259ccc07dd271c547ac743fd5f44326687b6e5a3e66310da7ffb309f835da62c682b60e38337ce47c629f78e3ffdaef161df33253bd0f

  • SSDEEP

    6144:dW8Wjz5CeTL8uxOWGoIn0TeifwjRBU9dTtsVJ1JQS:k8LWYdW7In0T5iRBYZaVJ1i

  Score

  10^/10

  darkcometarda abmdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2