Extracted

• • Target

    f03f4eec551892fd56cd50faefe098c3_JaffaCakes118

  • Size

    758KB

  • MD5

    f03f4eec551892fd56cd50faefe098c3

  • SHA1

    661a0acbd9d94e8a915e59e922af36022a3d8898

  • SHA256

    d8d95587173077265b251ef2ad7d0682a229ad227b5878d3d9dd9a638eef9841

  • SHA512

    7b6acfc53f86b281cb2e841c1ec3f851c2b4e7b30358ec29740076d1b888bb531e35ad6465be026cee4a2fac38632609f62b60afc323f355e2ab73ce47db9c59

  • SSDEEP

    12288:yXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uy:8nAw2WWeFcfbP9VPSPMTSPL/rWvzq4Ji

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2