Extracted

• • Target
    jaffacakes118_Adobe.FrameMaker.Server.v9.0.ISO-CORE.exe
  • Size 908KB
  • SHA256 02e6b0092b69aa9f632f64614866480e7f6e116c2110d8eda3f360f994e42b18
  • MD5 031ce9232ef92ac186683990bf20bf2b
  • SHA1 603e9ed14b27b0c3c451fe88397addc21f32b482
  • SHA512 56fe5a11efb0753bf4f5d08a21282aef6ab4af8ab0c074a60fc6151598a621c0e114d5b683abf227781cdb8ba927c2c6152bb83d05ac0045379bd327db80615b
  • SSDEEP 24576:sFE//Tct4bOslX/5kxNM6L/+/EQwHbKHLRjM:2SVRBkxNO/gHYa
  • TLSH
    T1DC153312B96B9CD2D4A68D721EE08AAB47ECFD740F48251CC425F2311EFF587215DEA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  newshostingdiscoveryexecutiondarkcometpersistencerattrojanupx

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2