Extracted

• • Target

    JaffaCakes118_fcca2bc6c99f84188dacb2d135dc580c

  • Size

    1.3MB

  • MD5

    fcca2bc6c99f84188dacb2d135dc580c

  • SHA1

    e6571099bd37e04ec25d6e6bcd498f5a103d3e3f

  • SHA256

    3f1d5330a734abb4fccef579be3425b398b26c5156ceeb5a4b79a2593f139e3f

  • SHA512

    838de77ac3ba57407e17725e328ed3e930b16150d7b6935fb70a44034217cde6cf6240121c4e396c5f7213e5d905e8683fcbe11407acd9320b225cc03d1fc22f

  • SSDEEP

    12288:PcrnJ8J4UcL/LYp7N4T9F324NYAsIkt5dC+6EIn8ddAPrUcXsZ/Fa4vZqmoHafMJ:YJear3Fm42hMiI8gNB0ipPsxFpUuA

  Score

  10^/10

  discoveryupxdarkcometguest16rattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2