Extracted

• • Target

    JaffaCakes118_68b1ba65d78fa7a547fe1eb195560b30

  • Size

    232KB

  • MD5

    68b1ba65d78fa7a547fe1eb195560b30

  • SHA1

    b2924db0b90a7cd1357ab37c011b0650f7cf6885

  • SHA256

    bd1a81e8a0505d314e1b2fa261db9ff554a76c4c783b863c8e6694bd6a2521fb

  • SHA512

    b6ee89144500df4a6d0a9961338fe91ab4a42bf14d61d6aad2faf9574b991feec3554c5b425a00c27bc343af7f30789a695d35d0aa6a8459e6488f0a3322cb5a

  • SSDEEP

    6144:3jFy93LU92VxOtVflFud4TnxcpPTASCmqMorHwMEoS:zFy9bPQZlFjrG0ZmYbwVoS

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2