Extracted

• • Target
    658988f2b817b216bc2e5d6fc4a2d189_JaffaCakes118
  • Size 1.2MB
  • SHA256 0f75723047e0c8fcd31f2c51ecf0ec3b920fa39ebaa2c9ab2c38a33c3e6878c8
  • MD5 658988f2b817b216bc2e5d6fc4a2d189
  • SHA1 6bddb74ac5f44bf9576e07894209e27cdf41600f
  • SHA512 c45223591741115ae827470cdd1c26c635ebe50b883e0917fe40e1b4ffe62d41691eebb977acbcbb434b4b1647ab5fb1af0ad9d28cc1eccd5df2a493c36baf9c
  • SSDEEP 24576:nfRTV3CBOQb5NsrsdBauN7+mj2SS+Ha5dUuT:ZTV3CBOGba8So7S+HaYq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkcometdefeultevasionpersistenceratthemidatrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2