Extracted

• • Target

    JaffaCakes118_89876ef0a94cfddbb4b31534318f54fc

  • Size

    1.3MB

  • MD5

    89876ef0a94cfddbb4b31534318f54fc

  • SHA1

    5c93e429dbf56fb484e24279c50175cdb9250b8c

  • SHA256

    3eacba75107f0586735eb29133eddc6bd326a5d69b6d72bfbd0b77519ccd07a8

  • SHA512

    ddb1d97a21d5364ad89b83a9f1c18aaac601d9df601412fc9c1148a8db6a5d9f4ed43b247201b80c81a020cf881e0bc40a3c0a05c9d6ed58d2e0f61439a39fa3

  • SSDEEP

    24576:AxLXDSHJeHQjiCA7BRSztzxdfhf6PQl1hfwUenzZQ:AxaHCGpyBMDh6P2wUenS

  Score

  10^/10

  darkcometthe joker hackerdefense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2