Extracted

• • Target

    JaffaCakes118_c179c544bd7a45218f62fb0cfc1ea52b

  • Size

    429KB

  • MD5

    c179c544bd7a45218f62fb0cfc1ea52b

  • SHA1

    ba0f425c8ce825b8ff244629ae39dae73fc0a3d3

  • SHA256

    1f4a44b25d0d5200e61ca5dcf37f001e1b3be5a240943b9f8d4f0f702872d272

  • SHA512

    8fe4a4c62085f3c65b7f9066cca6ae76478e827e48dc273b64af14d5eb8abc572276b08776f0acf8f1b1959f0d769b69e95932facf8a013bdc4cd930c992a9d1

  • SSDEEP

    6144:JPAObGPdNT+e7NmQgoHeYNIRBsTmRGRl0Wm8m1bjxZnA1NNUroto/:JAVNT+GH9NIRBsToG/0p8m1vM1Mr9/

  Score

  10^/10

  darkcometanarceedefense_evasiondiscoveryrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies firewall policy service

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2