Extracted

• • Target

    b0627d0748a0e5cbc86b021bd1bb71be_JaffaCakes118

  • Size

    400KB

  • MD5

    b0627d0748a0e5cbc86b021bd1bb71be

  • SHA1

    fc51e6bfc01f81ac51baeaba55a98e26e23834e5

  • SHA256

    7dc90310298e3d436abb10953908e7d57666270823a9511ac8645aede4d2d410

  • SHA512

    4cab079f7deed510105b50d703c03ce41f19c01b8a095667a09528dcd53d26c1f5753b314e2e0c54ebe6dab08f9f97c5caf75fa5cb99b1255f46e8aa568135b0

  • SSDEEP

    6144:UfA6Rv8jX0N9ImdCQkhk7uIvQdVTkLELuM9BDAoiQ6MsIMtCPzEOcV9U:q1sXmImdCJ7FdFzLuroizJIICPzP

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2