Extracted

• • Target
    JaffaCakes118_b8bab4c121e42017b8d18eb03ecc6aad
  • Size 1.8MB
  • SHA256 0ed404720a42ff3549edc52886f04cea167c27febcb709588f9cf269ebd7d268
  • MD5 b8bab4c121e42017b8d18eb03ecc6aad
  • SHA1 5e4a416cc651b7046c60413ffb4d6bf9b9a30c12
  • SHA512 040196d015b54008d69e42576a31a4d99543aeda2bc86b1b583c69b3c7c6b25e5232db925d6e850dc09e7ab0aaf997188272d626633ba83940da63152130e871
  • SSDEEP 49152:8NmIOoOOT9BsyjhpKQ1mdVy3I+XWmBroax9:omqBsaQWmQhXWqrLx9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkcometguest16discoveryrattrojanadwarepersistenceprivilege_escalationstealer

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2