Extracted

• • Target

    0d37824cb0dc10df2966d847302e3134_JaffaCakes118

  • Size

    12.3MB

  • MD5

    0d37824cb0dc10df2966d847302e3134

  • SHA1

    e163829ff705fb291800039cd76329c4d5d89787

  • SHA256

    f325a078aaa41aaf0c5f619dd2b6d9d1e4fb9837cc54aa2ab71c88aae95580db

  • SHA512

    81be17af1314fa34e5154e3e12ee53cf50c23b6fa8054656b181a570da0212f1696aa24d85bbce06d2d48a57e6fffc7d512bf28d5b2a7e74bb2c76859fff38c5

  • SSDEEP

    393216:JEgHFEEvurJSPUObk/q40p+iZKdwmJRXe08AxWouRlRSDxl49:CIFEEvurJSPUObk/q40p+iZkwmJRX981

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2