Extracted

• • Target

    8a069c028fcc956f46943f1449640a91_JaffaCakes118

  • Size

    1.3MB

  • MD5

    8a069c028fcc956f46943f1449640a91

  • SHA1

    eff5a8f848a043dd1d34c22e79914bfba59804fd

  • SHA256

    8fd9a7f984a4c5a9e2ba89ee5aa29b6dad95d09296a40984ab359aa6cde0bbee

  • SHA512

    180bf1d41b6151e235e87c68aefd27c38f2922570a937481752cec0cd5535da6d4e7f0c1035726aaaf5ae7e4c294cdcdb6a553965361836559d43ba5446ab4fd

  • SSDEEP

    12288:ANdxlPKsQ7FK9grZYg0nUvW9uzPPFhYyzGGzDrslSh/i+nNiiQ4qf9JYV578O92y:ANdxAsQAMv1/rsoxO9aXyvT8RYngUDrw

  Score

  10^/10

  darkcometrsdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2