Extracted

• • Target

    7434d1cee451fd00d640cc3946c205c3_JaffaCakes118

  • Size

    1.0MB

  • MD5

    7434d1cee451fd00d640cc3946c205c3

  • SHA1

    82710de38467e0118aeff2700300a2471f632b9e

  • SHA256

    d743534ac0e5438651bc24d3d5f6b26795f546d0be1f6909a4ead5e697f11b9a

  • SHA512

    76c1551bae19a5135380267e29eff600902b27189aa6a8a17745f187801a72cb6600b13fe9771123baf42b3ebf79fefee4e9a5a65e3e4028a5f2d8cc61732e72

  • SSDEEP

    24576:MZ1xuVVjfFoynPaVBUR8f+kN10EBwFPwIFPlGykr:8QDgok30hFPLFP/kr

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2