Extracted

• • Target

    8fd65814bd078eda0791a61a5780010c_JaffaCakes118

  • Size

    1.2MB

  • MD5

    8fd65814bd078eda0791a61a5780010c

  • SHA1

    8b97caa0aee826469463bdea635ab1c83839cf07

  • SHA256

    89d17b3353c51a9b562a9876c47bc7ae267811ec0cd0dfdc7e6d1c3a91cb3179

  • SHA512

    e0db0ddbfa6bec6a369ea71a4b3644f80669ba294837da0042637175da4018b50a48e41bcdd43f9ccadd8304e96d99382b0003bb45d1361f1406631747a53d80

  • SSDEEP

    24576:ajtcRyajJlTS2s7NAnY9nEswP+PP29PV7BZnf1utbZgSMTgtK/cRgOnmq9g6IB31:0klT8NAnYCsA9PVdfu9ZgvPcOU7m6sln

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2