Extracted

• • Target

    JaffaCakes118_14dc13e38626cb383369b09cbcc40868

  • Size

    875KB

  • MD5

    14dc13e38626cb383369b09cbcc40868

  • SHA1

    1927c7e274147ebffa367ade3dc4311ce4493c55

  • SHA256

    363ebed0078926a4beef0c3ea342331532b6f30c9f0e3a65acd98518b2c8f9e2

  • SHA512

    2c7bbf2aee2a37adb3466bebf62b77a23e651d87415db2971ce100d6707c1474a5b96db6035fce0f13a2044aebfb8bff3c48ccca9e5346e4fef1e8139f00f584

  • SSDEEP

    12288:RO7hN4/mj+p5iuEA1z7mc4wys1a/v6JyQZLcDE8ZSjwqzJ70WlSAfDEUfkOaaE:ROt6oenfymaH6J7LcQKTqd7dD9fu

  Score

  10^/10

  darkcometguest16defense_evasiondiscoveryratthemidatrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2