Extracted

• • Target

    JaffaCakes118_e94b4a77d7775702b3a9202a2ded4ab1

  • Size

    844KB

  • MD5

    e94b4a77d7775702b3a9202a2ded4ab1

  • SHA1

    c964d1a8536bf0e8f138d01f0d1b69a434dbfd57

  • SHA256

    75530cfb48f1c519981821298228ff8d17c0796fc1680bd104cde2f05a503db8

  • SHA512

    9d6236754a9f5a2e3eb0af4ea37515076c7df4fe425f01667d754112b7d5d4240761147957019e63451d2a6701163d41192aadc36cb4884e48f83829c104af1d

  • SSDEEP

    12288:2nG3skXuxE+BnMY5FksmW8WkafuZrIOd0l+eO/QWNPQyAln1l9v:av1FksmWDj4cEs+XprAt1lp

  Score

  10^/10

  darkcometguest16aspackv2defense_evasiondiscoverypersistenceratthemidatrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2