Extracted

• • Target

    JaffaCakes118_9457b2cd1a08799db8940186c5f31f53

  • Size

    912KB

  • MD5

    9457b2cd1a08799db8940186c5f31f53

  • SHA1

    26c340f41fbac82e85a700a2fd02a66ad7118f24

  • SHA256

    f8382a87bb775e3292a331c9f8593f74f1ce79c779c6b9fc3b5880119e166f5c

  • SHA512

    b05f863884afca7940a163ce7658090e2cf10e906c2da1bb0ee262fb165086ac17c5429a2bf7bbd662f0693238e90f72af1edd7aaf46174184d8ca6c813a93ef

  • SSDEEP

    12288:Bsm6a+fi4vNVDEumHy9obTWAoCQNbo75lYzZ+IrlV/3oWoYAWgyMHC0L:Th+BvXuTbTWJNM7jYznj/PotAMi0L

  Score

  10^/10

  discoveryupxdarkcometmr.rootdefense_evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2