Extracted

• • Target

    JaffaCakes118_1efdb83714007108190f2944d1daf62a

  • Size

    1.3MB

  • MD5

    1efdb83714007108190f2944d1daf62a

  • SHA1

    64b18fd6f491158e4376192c4a8f49a48afc6cb7

  • SHA256

    50fb26660e3e27515aeabfa0faa1a32a407e704700960cac1c8cb90362396a87

  • SHA512

    70dcb2fff90d5a746c9aa1eaa5a03a8c5fad3dcdaf0226a5cb83a4160191dbcdb445541df3291cff9de1899a24f6ad023eb421bc833c709cdd9c3415b94c2eb1

  • SSDEEP

    24576:Ob90u0wwuFQZfpcYRzCL8VlJuxHQ6YqJoJ4Sa6N1vvKht4Wji3GaHr:xwwiOBzJmYqJu4SaOa6GaHr

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2