Extracted

Extracted

• • Target

    JaffaCakes118_e9caf32e33bb954fff2c3fadb1e04a8d

  • Size

    1.3MB

  • MD5

    e9caf32e33bb954fff2c3fadb1e04a8d

  • SHA1

    7944adf221b1439bae9338332a270400c03bb77a

  • SHA256

    a84f921834aef064417f4e391e1e29d34b4d0bc04989e9cbbbd64318f8708e91

  • SHA512

    a3308bdcf72d6fc40df8fbe34c0a52da3c16fa228d10a8aa03941333a1015aa17b27c96808dbcdd47ee1d817a1b2f51777f2c2f9b230d8b2a317d7bcfde01412

  • SSDEEP

    24576:y4ktSIvTfZbkXWr+ypPiq1hCnCSyWhrtNSNXjJH4AUgMGs:8YkxQmKyplLS3RtNQCAD2

  Score

  10^/10

  darkcomettestdefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2