Extracted

• • Target

    JaffaCakes118_ea22dbe818b8a7031897429998ef8778

  • Size

    468KB

  • MD5

    ea22dbe818b8a7031897429998ef8778

  • SHA1

    88e152efa897a16193aed0ffd22410b96af6ebf5

  • SHA256

    46bc95e6cdb49ae4491cd29b9718d5f16c9c94c65bb05e8946274a5b2765d2c3

  • SHA512

    340a16f139dc7216f84092438b90e30ea33c80f07d6bbd940f2bda61aa3e0148ecfc8020536b19478fb15b62352c8515be5b73d1e693a5e91faf837c0c9ef7df

  • SSDEEP

    12288:qv6TtcangW9YrH3vbADd/z9dD4NOzIF4AK7+7hN:c5TAZBdDYDqAr

  Score

  10^/10

  darkcometguest88bootkitdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2