Extracted

• • Target

    JaffaCakes118_ff6773734d53c18f9ce325fbf853fc75

  • Size

    1.1MB

  • MD5

    ff6773734d53c18f9ce325fbf853fc75

  • SHA1

    d8527ed51bb03e3de2409ad5b76130cae83816c3

  • SHA256

    11e041cf0b21bcd2c148b26d21e5fe8fe36279f74c0ed57746e5d0f7459eea20

  • SHA512

    b2b49a5f14b581233b0cf49d3e9d9d4295de57f002f6e036299d27fe66206ee787118d8b7da174c60a64c94af09ada62c969254bb621c19ebd24a3f9e798149f

  • SSDEEP

    24576:8b6WS4ErP7wsecweQMCX6uHJ3uBKFz0WW/p9dEZF6D6sZvr:fIErPEsRYPnp36f/ztDZ

  Score

  10^/10

  darkcometadmindefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2