Extracted

• • Target

    7ba3d3b776ca05b6ac27ae82d86520de_JaffaCakes118

  • Size

    504KB

  • MD5

    7ba3d3b776ca05b6ac27ae82d86520de

  • SHA1

    5020d1290bbf735c9438be0425534bf6d2f216ec

  • SHA256

    f1801785e69750b6424c95a8cafaeebca9c9d69a99906a311219bdbf38609c3c

  • SHA512

    c6b600de831478352dd76a9b42dcaba2c139c47db7fd63a5f345fee6a1ee6cdcd5c84685839114e348a7d1e97dfb7f07c46429d8bc675c64085c4272b80535fe

  • SSDEEP

    12288:+/OpE4MDdbQzd9mLK20LR5RmZ21WhKERSiGrLm6Z3NnC:+/OpE4MDd6dc228X1WAERSfrLm6Z3NC

  Score

  10^/10

  darkcometúçôþ ñóæá çááédiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2