Extracted

• • Target

    JaffaCakes118_822fa2afa7f2a8665ee145ccd950f5ca

  • Size

    584KB

  • MD5

    822fa2afa7f2a8665ee145ccd950f5ca

  • SHA1

    ce13c1ddb939654fc73ab1a2f9bb195b02a0e17c

  • SHA256

    1f43c14aca004721c246d400425587d99104d466d46a9075c84e8c6ec6c2b136

  • SHA512

    70ccb62847b7a0544b9d037e8a9923295cb6510fe7565313b5c03f9ab8b0520c3288ace5523c801ce27d804bd76f9e7b65ab3e581c0becf741f14461fe26d591

  • SSDEEP

    12288:JzpGGsvC4R8zPq8Dfji/pEmuUc1+e5zWlT6x:942qUji/y+Wzks

  Score

  10^/10

  darkcometvictimev12defense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2