Extracted

Extracted

• • Target

    JaffaCakes118_1615b480d567a07954c274467f257000

  • Size

    841KB

  • MD5

    1615b480d567a07954c274467f257000

  • SHA1

    844d3a68b7062e21f0dda12eea0536f1cf55becc

  • SHA256

    689f36685dad88807aa3b5ad0a5d9a1dc1b3c2981a8fed14f8350e7b7a4f1bb4

  • SHA512

    e6adc547973dd760d36adad09f9d0a79e30524fbd5c0db82a36c026f2274717ca8e9788bd0a8bb600cf9406630c4d45ca01ea6e0d6fa1bb21e1cc6acadc7cec1

  • SSDEEP

    12288:BDGRFBsZyYPBjRUowOrhpjW4HyzCbBZ5FYdGPKDFe/WunlZHJ1PeM9IcK2+Y9V+o:BSxifRZhvj1SClZOJ5ulZHLac5zV+S9

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2