Extracted

• • Target

    JaffaCakes118_1e58be1563f8b966f2a8ebba2ee0bcd4

  • Size

    758KB

  • MD5

    1e58be1563f8b966f2a8ebba2ee0bcd4

  • SHA1

    2a670070215a517c3cf2c5d398da9affd7e14c9b

  • SHA256

    2404edb5753bc2200c7c8e88bbf112296001ea89227666e977c00bf2f25f350d

  • SHA512

    43294d200d2314b8cf2da288ef80cf5f5bd1f714c17a29a590640bd0e8acbdd7c06dd9938bb96fb61405004c32cdbed1f2b85e2a67ead0bcc8d1d76e7f5c8f17

  • SSDEEP

    12288:KXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1MZw4JuMkth/fy452UO:UnAw2WWeFcfbP9VPSPMTSPL/rWviq4J5

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2