Extracted

• • Target

    JaffaCakes118_b64c82d841f0ca478ee4b052973ec8de

  • Size

    1.2MB

  • MD5

    b64c82d841f0ca478ee4b052973ec8de

  • SHA1

    1d6b7f8243fff0e5cd771e999c9098423e99eeb1

  • SHA256

    32c7f3af9df7f9d50047f168e069bd4e06122efe825db2dd0fae34e2c05ce9ab

  • SHA512

    1d9bfe0e21a6c1639eaa908fef16d3d6777fd0fb08ccd3c014600449fb5df8977fa58986a2afa49c4971b18f63ab802fa779d70e78d4fc3da7314dfbe5c38623

  • SSDEEP

    12288:/V9QZXi5ITtw8xqm8LlO5/8h4+9Ymoxefl5QT5VVpJ5PCf/BPEsKZXCa6jpoLuJl:UTtNkoxBUJjTH6FyTKJ49HGjNA

  Score

  10^/10

  darkcometdevilskarteldiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2