Extracted

• • Target

    dc1c009149df32f04373b3519dfdbc8b_JaffaCakes118

  • Size

    1.1MB

  • MD5

    dc1c009149df32f04373b3519dfdbc8b

  • SHA1

    aef5fd7a3cd4351d96c53f4bece6a0cdf7835029

  • SHA256

    619ccf5b3f6fe85d1887645e84ff4d480c7f53a0903a00fee2b6a4a3cd46a458

  • SHA512

    1ec3919720658c495ead64f44f1eda2f666216f664cbad60890be18746b1426b242691d726ee51de6b48142e61945d148c21334453b23646ead33b2a482828d0

  • SSDEEP

    12288:DaWzgMg7v3qnCiMErQohh0F4CCJ8lnyC8idoH8DVqlXueHrvNI8qNHiUXdWTJAAT:maHMv6CorjqnyC8klDuHbNInHRC2WhZ

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2