Extracted

• • Target

    JaffaCakes118_07c0b59dee261086d7a85b18bf4c1689

  • Size

    1.2MB

  • MD5

    07c0b59dee261086d7a85b18bf4c1689

  • SHA1

    a5914159aa80b1b4edca311344bd8d49331fb62f

  • SHA256

    47a8bbcdbacf5ffc6824fab2b4dd3d0625174f9d68aa67fd0eece5ce9fd2d7db

  • SHA512

    a62a654a07f9a6d71a30f0189b03c27008594aabdc7819e0a9d63d75297a42bb3014de64d07c25a52518ff590b433f38d5289d99a80105817955adf10247afef

  • SSDEEP

    12288:zRz5f7CiUySyZplm/VK7Ba1gMUIC2DjxOCDQtaHehQK8y5Av3vW1pIhrRRhsLrIu:zRdfUkC94sUC/vnakTTjcccV

  Score

  10^/10

  discoverydarkcometzombkdefense_evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2