Extracted

• • Target

    dfb218edd9631dbf712d1667131f8114_JaffaCakes118

  • Size

    304KB

  • MD5

    dfb218edd9631dbf712d1667131f8114

  • SHA1

    06b5e317a8ff1bddbb509becc45f4014c71c04ca

  • SHA256

    28199b9441679f82b096fbafa934bdcbaf4ce58524249242db6e8c1f021e0902

  • SHA512

    f3c582c942c9fb5527d9b733a264d3cec233c652e30befce0882eae2edfdc2fe45c114042683c59383af0c012bc03888fdb9edf431c6baa14489c2cfccf26552

  • SSDEEP

    6144:wgDEKyC00xuqvXRaunYx1wR2pD0qdgYRO3n5Xq7XV+79Awws:wggKyC3kpunswRyFe5mY71j

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2