Extracted

• • Target

    7489d6d9182cfb315a028a9670a1eaa7_JaffaCakes118

  • Size

    501KB

  • MD5

    7489d6d9182cfb315a028a9670a1eaa7

  • SHA1

    6248b643e2700e60960d7ea7911926310d6bdb41

  • SHA256

    539cb4699daed68cce319ba88bb97ed2211321ab7d8342370bcd958f3de6af38

  • SHA512

    8e795753a7818a5818f29586b57750f6e397475299924624d4a27fb9a8c81194bf16b7c6af108dbc4961b222dfe7a3cfedcf8c7be040bde27b3cf6ec485dc4ea

  • SSDEEP

    6144:+pnVaARrQbqPwZQU+gr+h8Ug1Dgpfd+5R8Kyt9oXtzYYjsUE+ksQIPSkh7h/SL:Wnka8AHeb405Rt9Je4/Skh9/S

  Score

  10^/10

  darkcometguest16bootkitdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2