Extracted

• • Target

    4e80168bcb2673f9fb284d339a1f36be_JaffaCakes118

  • Size

    794KB

  • MD5

    4e80168bcb2673f9fb284d339a1f36be

  • SHA1

    55d06c980caf3920a53846dfe106c2e83fe11fae

  • SHA256

    5732ac20218d329557e17f8babfa74c8ecc5035b2c021d80ec42da75a8c50926

  • SHA512

    d12bdb85500d096ba714c2b742ff63da99ff5a2aa69ae23d661c9ab4c9ca8beca458947c813a4c03127b22ef10b9bab5a07c17dcda623021ba4e3526d519e021

  • SSDEEP

    12288:7l6RkwVNVSNW9dDRySO94a29sL1Ni8r1NTTbsTohYWEgRW1ah2M:7wkwVmNW9lBNs5Ni8rXTPsE3LIahR

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    evasiontrojan

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2