Extracted

• • Target

    1853e7c8b1b062e5f38559ba957bd6ff_JaffaCakes118

  • Size

    756KB

  • MD5

    1853e7c8b1b062e5f38559ba957bd6ff

  • SHA1

    b5a07baa516c646ccb389eb4219feae21b118c6e

  • SHA256

    a50b6193e2bdda6bf35018e9e05ff520181228be00f975d3d69282bf945bad93

  • SHA512

    8d12c94210c6ca6079c14a071815343441d300595657c2e71146c62feea5f73b6d823a0630f2e16043c4c618b056072fed695c94f1f7694b5326ed567bd31d1b

  • SSDEEP

    12288:69HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hfh:2Z1xuVVjfFoynPaVBUR8f+kN10EBlh

  Score

  10^/10

  darkcometkurbandiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2