Extracted

• • Target

    JaffaCakes118_614542b000a8b8b16a4efbe1cc858740

  • Size

    349KB

  • MD5

    614542b000a8b8b16a4efbe1cc858740

  • SHA1

    20a24f0950628023df472120fcc12c1f3fe603ca

  • SHA256

    423fc644a8ba25e3aa1d762aa7d8674a9cd48c395a748bfab6bf2313b53c0fbb

  • SHA512

    8e818ca26381769342da858eade9f23263327931475895509665d35bccd579e3e14ba373a1696410adce4264fb99c5e1b350ccdf17f8e92872d7b4540057cef2

  • SSDEEP

    6144:EcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37EBLLjMdWnpQZh9h4:EcW7KEZlPzCy37ElMd0QZh9u

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2