Extracted

• • Target

    JaffaCakes118_0779804f0ce3c93cb66aa873be4a24de

  • Size

    278KB

  • MD5

    0779804f0ce3c93cb66aa873be4a24de

  • SHA1

    2fd6f2f63d46d03e111c13e08fea4d53f527a510

  • SHA256

    421af115c24f8bd01f2848f365414a189b440a58fc7978eecf7d4392b4e3ead5

  • SHA512

    797cc825ecc3edd07034259062506c6b76d2c98cef5d646dab78789921170331950342dc69271442750a2fd5c9fdfb3517e706631fbae6fa395aee10d31f9bb5

  • SSDEEP

    6144:uWZkfDJW+rl4Qzg2pkbGPGHoOrI0s0JYhvy41kkR2wDEbBRHgN1:uWZkfk+rOQzZpDzOr1mvlRbDwk1

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2