Extracted

• • Target

    JaffaCakes118_006100d05d0b0406d17ab8d0429e207f

  • Size

    283KB

  • MD5

    006100d05d0b0406d17ab8d0429e207f

  • SHA1

    e189b7f5a34bd3dfac8abcedcae12cfa0748f337

  • SHA256

    36d4617c693644deef588b58f2a8b57ba966247c8fd435710cd0764cce1b9c93

  • SHA512

    e94aa925b5167c65f751bb5b7da668ad501dc5737435c757015aa9ba79ba99996fbffc8226b7f89a6c24090bf0fe978a640640a35290900a46bc241fe4643cee

  • SSDEEP

    6144:vcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37Pja:vcW7KEZlPzCy37ba

  Score

  10^/10

  darkcometguest16defense_evasiondiscoveryrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2