Extracted

• • Target

    JaffaCakes118_c04c2ebfdc6dbf7f31531aadb9ca90f8

  • Size

    334KB

  • MD5

    c04c2ebfdc6dbf7f31531aadb9ca90f8

  • SHA1

    59a6fe3fd6417e748cd7c0359b6a82479def1234

  • SHA256

    d68025b5039a61bd516ec29b39b98131f8d81ea3b29f34994d11bb018b727280

  • SHA512

    21fb582f105d1730c77b447f73c232b153e7821c86297ef7ebde78c36567fe847b71735705d98d5be6cf1912df610f4d27ad707ee12c82a8fa6068f19d28dc12

  • SSDEEP

    6144:zYp9cIMnhkMD5TCn0AQHvB2z5+Nq11S78R9RhXsm245DDPwHAoZm/v:8HD8hkMDgX0Qz5r11S78RCk5Hum/v

  Score

  10^/10

  darkcometnwsdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2