Extracted

• • Target

    JaffaCakes118_f3c53c40837e1e4c35d80a814a6dabde

  • Size

    360KB

  • MD5

    f3c53c40837e1e4c35d80a814a6dabde

  • SHA1

    93d3518db78170d74afdf701ee06f619b8074f44

  • SHA256

    847a898a97ff150c08dab76176e8828bd125122c2ef42824a5bfc76465013a64

  • SHA512

    4777db55eee08516dd7efd83c154cf02ffbbd12ee3d117c844f91c9ad5c289d7d4e7ce3a418d380384da95cc97f77c567ffab85c9fe4745c05dbf58e1e8cad71

  • SSDEEP

    6144:ZlwWw0fgpl1uCo7j3D70aoJ09AdtttmrxVpkXPaTgBjn+6pd7SEKrWD5UQ:zw5vfLonzpMtTgyaVW9U

  Score

  10^/10

  darkcometguest16defense_evasiondiscoveryrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2