Extracted

• • Target

    JaffaCakes118_85bd61b26a3e43e7b28406fcb48e45e3

  • Size

    278KB

  • MD5

    85bd61b26a3e43e7b28406fcb48e45e3

  • SHA1

    c38fb7663b8503a2633ad84a618a3c98cf30b221

  • SHA256

    e2011aa164a93edf2066d917e3ce2e403629b0ecc83494d48173505784fe5225

  • SHA512

    4965b7f43d1ad3f2e22d059fb76e12490aa4b211f26dca52519c5808978897a381f29e7f1f21f33449ad2457449972fc9a798d208db80d12f1017726facab09f

  • SSDEEP

    6144:l4eguxQku0y/3AZIl8VUPx0GId0i/JYkfI1LNhhItGvIr2Va:l/guE0QA21x0zjxQhN5wyVa

  Score

  10^/10

  darkcometvictimdiscoveryrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2