Extracted

• • Target

    1f8ed890e0080167696df9f4d8a153a4_JaffaCakes118

  • Size

    869KB

  • MD5

    1f8ed890e0080167696df9f4d8a153a4

  • SHA1

    6aaf29cbf84b75f28d316503bc8034d4e0f6abc6

  • SHA256

    e490d74d2ae5e9b84e7a341b47472da7b241daf92e64da760d9206043c411d45

  • SHA512

    992e897e20e6cc222aa810b972175efdad94b59a5140b805ae1e98b4fc9c8d03c68d52cecb7f483433c4898ff51ba7d1d76e27e18d069f445f909d94725dca05

  • SSDEEP

    24576:G0QRWoJEfg0oChGdJQbjPbNW5tYeP+GF4h7uVkAg37:RQRV2o3MPY5Axh7uU

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2