Extracted

• • Target

    94fc05361686cc76105724d8cc663f21_JaffaCakes118

  • Size

    766KB

  • MD5

    94fc05361686cc76105724d8cc663f21

  • SHA1

    b9e21c902130a80a15184cd7cc1d676179308fcc

  • SHA256

    54e2ab2dbcb18c522c92f64a482234523d6e653d765376fba092deb16095c112

  • SHA512

    b27dbbb363208be0cec6b3d7c5c1997141640aedbc48033fffd22e4d5cd6ebc5e0fc196340190444371c58bc36c9e8ea2311ae7ab5b5482accbb2519306dff4a

  • SSDEEP

    12288:MWM00blAckjJmUgFuSYSTKBA0Plr1dSCCHTp1/nW2BqsvD2MjQ:1M00bOcYJmX85SMA0DCN1ZDY

  Score

  10^/10

  darkcometfundefense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2