Extracted

• • Target

    b88941407d61d4a039208c3e9ef7c620_JaffaCakes118

  • Size

    251KB

  • MD5

    b88941407d61d4a039208c3e9ef7c620

  • SHA1

    f02266d031d4db0d610be6df08895299fc72c8be

  • SHA256

    9b3c3f216155ab683b72ab4062b0a57ee3194e49cc73b1354ebc38f6c4b671ba

  • SHA512

    4a6fd8640ab96a3ea1885f22a5cf39648e14acd3c3a410d3020773ec7503a8c363d88b4ff1ff7333473790eebc78c5da78f98812a798f2e4ab3597ffc1d69a50

  • SSDEEP

    6144:QcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:QcWkbgTYWnYnt/IDYhP

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2