Extracted

• • Target

    f6aeffca0e1cf8e83b427d4f9504d78d_JaffaCakes118

  • Size

    758KB

  • MD5

    f6aeffca0e1cf8e83b427d4f9504d78d

  • SHA1

    260c5fde43873a2a5908d6cbfe8e56756c8c1565

  • SHA256

    0134132faa0cd4ed6702b1799d68bd600f88c30224cdd3eb3131559bc3568f21

  • SHA512

    e94db51a2db03c032e1a3f33059341d4577cb9199828f58bf04ea04d5d9ea1a4eb2f001dd9e6d2279730d772671ebfd2f8f0ba0a9df881e1c498fff27db827e4

  • SSDEEP

    12288:CXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkwh/kb:snAw2WWeFcfbP9VPSPMTSPL/rWvzq4Ji

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2