Extracted

Extracted

• • Target

    JaffaCakes118_ea271405c5d515469356a082f5a16dd6

  • Size

    891KB

  • MD5

    ea271405c5d515469356a082f5a16dd6

  • SHA1

    bf2b2451d4d8e656067c81cf14362b9702ed7a57

  • SHA256

    91a04cda5888aa5c4e0e8cdd09d5576836d3714c39446a510ddb7f88ae372ae4

  • SHA512

    dc3c5ea202e4e311cbc35dc8d53b616bf657de01d91da9ce0e92ed39616424b3002035e41fe915791ba53f9b8822ea2c9100b22777ea0a4dac438be71a283440

  • SSDEEP

    24576:kKtgTB/3lPQZLh9h5qKUpEZl8fCjDS/2V0cs3:TAB/gLhw/ajDo2V0cK

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2