Extracted

• • Target

    ffc2e4b24496363b727f6e4dbca30824_JaffaCakes118

  • Size

    1.3MB

  • MD5

    ffc2e4b24496363b727f6e4dbca30824

  • SHA1

    596e01d5c84cd459689c4bf69e3f83f4575be640

  • SHA256

    039fb1c8675255b8edefc207b6362e0da58b6d9ddd767fea06a705ce54326fb8

  • SHA512

    75a8da478550e1922621d3bbded40dd9baeb6e292cd493c8a5e116344565f20305c67969fa07f390ab54d113fc0471cdf37888dd2015cea881e7e4da10549493

  • SSDEEP

    24576:xv3eNL+gpwfoYqFzwRWGqx8BsptOwCRS03kWaZYjEeUK/cRgOnmq9g6mzk8Axq:J3e5+gpwIFzwzqxmsvOPS0UWuucOU7m1

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2