Extracted

• • Target

    JaffaCakes118_71c5c3921891aa17a545b12b9081b3ff

  • Size

    504KB

  • MD5

    71c5c3921891aa17a545b12b9081b3ff

  • SHA1

    1a059895434dc4a8e40d19d8411b1432dbdb2060

  • SHA256

    a0765d2800c0ad0ee6dff1f252f63e26ccf759739c48d2c008c67b1be106a8b3

  • SHA512

    cb53f8644fbfa8d6dc5b587c87a21c2b4de9fcfe798e7bc95c862247da39087a1c8cdc60795dbada03762963ed922790a4140128ae949c1b168bb9180d12f12a

  • SSDEEP

    12288:G0Qr0Mk7z+4KMVzDfrTRYQ3+WltCiHE4vTB3cw7m:GBkxFDf/RkWjJvTOB

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2