Extracted

Extracted

• • Target

    JaffaCakes118_0f3fcc0d11d52a00d58999c09ae56893

  • Size

    2.2MB

  • MD5

    0f3fcc0d11d52a00d58999c09ae56893

  • SHA1

    c379bae74dfae67d22a3c13c50634b6d22ed3852

  • SHA256

    58e243533df7be838434753ae8b68b5b603269a532b7567bf90a94ad25db80af

  • SHA512

    4b4efec460371d05c3becd0485e7964daf7c3c314398ca568c5222ec1e41b1d8df5d4b4d90a44cdea247463ca1398331e6a20c604730830ee7f837188d3e7dfb

  • SSDEEP

    24576:ygsSOe92bfUTogmbvuTG312E1FVXHo5t2ALj8Ffp/UphYYxWz8T:ydeD7NE1UR/+pqhsz

  Score

  10^/10

  darkcomettest vmwarediscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2