Extracted

• • Target

    JaffaCakes118_607bc4ea4898f2c882f87bc7a8f3503d

  • Size

    251KB

  • MD5

    607bc4ea4898f2c882f87bc7a8f3503d

  • SHA1

    f785b8794cee2717fe825b18b6293dc71da239d3

  • SHA256

    9b42c96f3be2f7ba8da3f9bcf16b7bcdb9bf0ea85948a1605a66e58ed9e36c06

  • SHA512

    ddb45fd390eb7662a896ee46b3026fc8d25d7c5cd9adbe235132d5793f999df9db9e98ecd41b4c6e0fa634c4dd02a720825d6e368f2847fdfaeca935bf3414f5

  • SSDEEP

    6144:BcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37G:BcW7KEZlPzCy37

  Score

  10^/10

  darkcomethackedguydiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2