Extracted

• • Target

    JaffaCakes118_ba43500c74e4f71797f906e4e643a916

  • Size

    424KB

  • MD5

    ba43500c74e4f71797f906e4e643a916

  • SHA1

    8334af3e31ed73f95d3d959263e1579bea2dc63e

  • SHA256

    6784118149ec8f2d9fdae8907445a4c944c58b8c93bff924d4726bf1f10a7cd2

  • SHA512

    824965e4529ecd99a26d08cdb81dd322e4474d8377dfeb55697d65b291f460d3644888f1c6189c340fde4b5fff01f651a9eb59d611e4d9dbadad1e1c11e80eb3

  • SSDEEP

    12288:zTPQEzmVkpm40kqZnQu3a7vAS7aMj0rapPM/H:+AIgmMg

  Score

  10^/10

  discoveryupxdarkcomet1rattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2