Extracted

• • Target

    JaffaCakes118_0b14225cd21bff8fc3eaa2c1f02a2170

  • Size

    340KB

  • MD5

    0b14225cd21bff8fc3eaa2c1f02a2170

  • SHA1

    eca9f8b58cf005086da39710535f51e04e960a79

  • SHA256

    e66245e14577b896bd02a8a7e7d49d45df12566bc3c8e63798715a6b2067e9a7

  • SHA512

    1fca7b4fc74319a872cb0bd3ce258249905d6b01735b9c7ad4b91a9894dbe11f3dcfe4da740fcc5592204d95f919816b9b9698e284316febfd82821b9452c710

  • SSDEEP

    6144:E53+WTVqx/FEx5j8+oFBBo+8bb+L6KvJWxbzUOM+:w3+mVkU8P/S+L6mMx/VM+

  Score

  10^/10

  darkcomet!@#clusivedefense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2