Extracted

• • Target

    JaffaCakes118_775098a7a37f647bfd8e1f939d8771df

  • Size

    333KB

  • MD5

    775098a7a37f647bfd8e1f939d8771df

  • SHA1

    4c5147d5d16c3cd1d9b790f07d06084807cb14af

  • SHA256

    c88f8c13f73d0ee32d0b3a83fce6a383e74234d2ae7fa58bae07cacf0946ff4a

  • SHA512

    b34dea42013c8318b64075332d7a2f8b46f9609ffb759aa659ba2b9f1edc473940e973616ea2e406680920d2750718cc47ae8825a600e2b02505ba8932476b3d

  • SSDEEP

    6144:4iEoiNcdTzZrcxrHHTMXcqEjSrKmwToZ5n:LPiKdTtrYDHTaFmBK

  Score

  10^/10

  discoveryevasiondarkcometgenesis999persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2