Extracted

• • Target

    f0fbcf1170872bbe1ed04d118bc59a24_JaffaCakes118

  • Size

    351KB

  • MD5

    f0fbcf1170872bbe1ed04d118bc59a24

  • SHA1

    3ce2e875b4a2c8f7315303c2b74f1ad593de681e

  • SHA256

    bc53a12b9f9b91b8b559e5725a35f0570cc9e00b28c0e317efd22da0fb202292

  • SHA512

    90b6f08cfab9e4971bca771dc8156a473d4ca7b475d1f6fc270b1ad86cdf04642d2c8124f84bb1f4bd94c830b31fdff33f986133bbe38b49882f14bd6f3ef84d

  • SSDEEP

    6144:5D7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZBgaPlbL:5l8E4w5huat7UovONzbXw

  Score

  10^/10

  darkcomet1221discoveryevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2