Extracted

• • Target

    72212799efeb70dac8ed957e6503616b_JaffaCakes118

  • Size

    1.2MB

  • MD5

    72212799efeb70dac8ed957e6503616b

  • SHA1

    e7fd90088f8060c157bb2aa6766726fd7d0d9948

  • SHA256

    48d1664bc3d660296658ef0748961a585492f28d03804fa4f18720cf1476378b

  • SHA512

    0cdf354752ebd511b7e04f0fdc98eac4027de5be54e9f8754535827a1f2c81abd005b9f7f6c071912113c1515dc101f84080c87250f21b780d7945b3b48bed39

  • SSDEEP

    24576:BSGvv3I+gyV4tq1KBTVuArGrWuRrv9SuhXgu+ex0Rst5pzveyeNA:BSS5bETV3rMWmz9hWRwpiS

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2