Extracted

• • Target

    a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118

  • Size

    496KB

  • MD5

    a42208c4a96c249f3d6fe39f43144f36

  • SHA1

    ff90b696d74d75932e122c774a95fc4671a41d86

  • SHA256

    245500ee74fd9b8b021c38be617d72261d02a6d3fb8f9402fa0a10d5a1f41f93

  • SHA512

    ce1977713291c941b47a1435f55db11e18a882a2c452b1a57bc115db68206d13c7b67fd780ddd728fda20a8fa5b329218700ec6c09188f3e8b9d1e0471fa0869

  • SSDEEP

    12288:tFz2y90KU7E7B8aNHaqGQnZrCIn3dTTXV2hl:tt2yZU7E7SaXGQnZuInN/XVe

  Score

  10^/10

  discoveryevasionpersistencetrojanupxdarkcometserver-axrat

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2