Extracted

• • Target

    JaffaCakes118_66c8b6e79111811bb5d1a6347ea5a2c7

  • Size

    1.0MB

  • MD5

    66c8b6e79111811bb5d1a6347ea5a2c7

  • SHA1

    f776ce50d7276e7d853237be8c461630642d2492

  • SHA256

    80dd309638e1ab53050b7d313ef34e0591095c0f873366c8343f07e481aa51ed

  • SHA512

    55c94d0c826b2e0144a6372ad9da0416602bc1477f2532683f3d2aee8133783393f30d146e26e8be44a813ea4a0544e59bf4d792096d953aa7a550bce74400f6

  • SSDEEP

    24576:qMwVWG/If9sOc3/gqNx5FGGwAKSFZzr5APUTF/gOF:q5W5u5FpTKIB5A8R

  Score

  10^/10

  darkcometskynetdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2