Extracted

• • Target

    JaffaCakes118_07cc837818418c77df495ccb7b446cf0

  • Size

    754KB

  • MD5

    07cc837818418c77df495ccb7b446cf0

  • SHA1

    bad12f59017d041fd92cc2c07abf0f1f0de60652

  • SHA256

    5c0789467d430f720b12089c27492271faae3d20b7a4595bba2a119e7d6a2d39

  • SHA512

    057e3359eb0af5693463ae2b1b8b547c8b4719789f6de362029cc01775cf9413785395dca607a6278557c50b6b2ba334a6ff04803c1cb01b669ae2ebac14758d

  • SSDEEP

    12288:WPSQoM7Pk7H2ZP6Zd4Z355gcclvYZuHVGkmBbsZpbKp9VQ/:U97Pk7WZP6Za3XAGuHIkmBbsZpia/

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2