Extracted

• • Target

    69156eac01c507084c6bd8b7af7769d6_JaffaCakes118

  • Size

    952KB

  • MD5

    69156eac01c507084c6bd8b7af7769d6

  • SHA1

    1eddee605bb79c13341507c4a50b68c0ef07fb95

  • SHA256

    6a2db423c15e53a558c436839b32a461e64bc260366162d2571b4470fc2e7bc5

  • SHA512

    c1c41c9566431ed5f8062ccdc6cb3ff8cc4a3558d51cb821ce6fb7481f8cefb06b6805531e7ff6bad1cdd750b3fe83d5aa877c243a1e78c98a37ca9285e16cec

  • SSDEEP

    12288:Wv5p+iUxpoAf8o7sB3eseaRgqr4bNeqn8LJNAhuc6xDmasn9WQ/IkvhHEdEgMgyB:2+iUxpSEaHr4bzoa6xKHnz3Hq0

  Score

  10^/10

  darkcomethack3r88-newsocketdiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2