Extracted

• • Target

    bbf781c69dce4173c7e32ab6b10b1ee5_JaffaCakes118

  • Size

    609KB

  • MD5

    bbf781c69dce4173c7e32ab6b10b1ee5

  • SHA1

    d47df21ea314b6ab30678860817936b4ebb0c0d2

  • SHA256

    e73e433060da887b9e19f1a0fb9ff4da2b8a0711e7e668078159623773c252c7

  • SHA512

    1ca47259ec4f0f58577858795007ad6c0ea7cdedefaf19c115da073abd82fc0a3ee3c88eb79368c4ee33454c6b305ddc358098516370ae525b0cf3c492df07a3

  • SSDEEP

    12288:eIOpcu8WWKTnjS0tLeYmP98JLK7aXGZkmdYgG3slEhavoFSC:etp9WK/S0tLs9wKOGkmdpGUoFS

  Score

  10^/10

  darkcometunidiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2