Extracted

• • Target

    4ad69c1a5f6459baf6fb722edf533f49_JaffaCakes118

  • Size

    5.2MB

  • MD5

    4ad69c1a5f6459baf6fb722edf533f49

  • SHA1

    f47f0c62826013d8506700ec7c5c2a5f3dff6bc0

  • SHA256

    16b23e2f1893ebfd6d98d5ba8f6ff45d143a8b5fa0672fadaf0e44be72b359b4

  • SHA512

    0d91fc35dd06a457543f9163231ef39f6913052641a35e21d8f8e234705277f1ab3fd30072fbd2b880eff8f1548455d09fe6c8c4d84f9bb92424fdf3ec6724a9

  • SSDEEP

    49152:6QDgok303Zzl6QOy94YaJuFXkTIlrZ0ISiRctgVf0d2ZKwr7cUxEUotoKVbmqSEq:6QU/sZzNqNM+IbBcfdHVbY

  Score

  10^/10

  darkcometadminastordiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2