Extracted

• • Target

    JaffaCakes118_00a4804e5ff628d91bacaccbfa41beeb

  • Size

    855KB

  • MD5

    00a4804e5ff628d91bacaccbfa41beeb

  • SHA1

    e1014862ba1d2d4a2e1da1452fa7adcf3a3b9de3

  • SHA256

    0c22f65c096a3ebca29d800e2e30c1291229bd1db3b2cfbe9303ab7def9e9111

  • SHA512

    8e5c0844feaeb8f9d1d1b6a8b21be8778a16984e0a1dc717dfe193f5aa6c5e9a99d39313a3ec16af71b45ede2bb82546de0cf28a331985c01157c1e676aa6f16

  • SSDEEP

    12288:tca+CQY9l6sJLKCBRJ8EsYZHHxVb3vM3ZTAmApSFghd30TQLzMkxYZ/h:u1CQKljLKyRpHH7v4ZT5gj3l0mc

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2