Extracted

• • Target

    c5299b30da386f35f3790d319f0e36b1_JaffaCakes118

  • Size

    317KB

  • MD5

    c5299b30da386f35f3790d319f0e36b1

  • SHA1

    71becf548d73aa07d1f30249b6408d8abcedb255

  • SHA256

    f144ad04d245bcf8b95722f9e7de1665241619a75617e34e0f2f8293049f53c6

  • SHA512

    22f88d77dc54f34df03937bf1c6b62fe7a37289f9696703ee5fdc5fbd04c1ae9d9c1465629454668021ed8775125f0cdc13991ad056e413246d03f4539407b7f

  • SSDEEP

    6144:8SncRlBBJVqu5jxRl+t6Ge0qw0kw9+Ks9a8/7z6lnHru2k/:d4ztqwjxRl+t6GfL7zc62k/

  Score

  10^/10

  darkcometguest16discoveryrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2