Extracted

• • Target

    cc2f7185c6f4fb6308920d5a5676a600_JaffaCakes118

  • Size

    718KB

  • MD5

    cc2f7185c6f4fb6308920d5a5676a600

  • SHA1

    2b5d0eb8e5cd4f76b3504e5011d8eed711c9fcb5

  • SHA256

    fba9123755068d98735d9c5a00d99abd57a90acaccce9b1a0549c1aeb76613dc

  • SHA512

    ffa55b7d96a57213c98374332d26463b9779bcaff52a509df9e523f8e4171770859666bcf07a7215c4c31941269c8d4d89f142d04df8337d7ff174859bf7c67a

  • SSDEEP

    12288:QL88mbu2rpKomPPijFbJ34tEZCgWSZkK5VdKbggPdOXwx6vwGpy30Yw6m:b8p2goysF4taCgVRdiNlOQF309

  Score

  10^/10

  darkcometfodiscoveryevasionrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2