Extracted

• • Target

    6bf69b1a5506b92cd31d73daa9a38af6_JaffaCakes118

  • Size

    681KB

  • MD5

    6bf69b1a5506b92cd31d73daa9a38af6

  • SHA1

    f3a342a634f810a275b73c89ed8725fe1da41d7b

  • SHA256

    d74a908c52c20ffecce292ffd6e0fa73c5b54870c7117c64848d6e841412f9b5

  • SHA512

    c009ad1774abd789e0cd8d286860b61fd161a7993c81b0e8664c05ad7195cafd3f332e3076525313bfbf69df24e30f831566d8e5d54daec7260115483b83d437

  • SSDEEP

    12288:Xk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+FlU:00QRWoJEfg0oChGdJQbjPbNW5tYeP+GZ

  Score

  10^/10

  darkcometvitimas uoldiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2