Extracted

• • Target

    JaffaCakes118_2d267f4e282ea7e2160701752190d17f

  • Size

    1.0MB

  • MD5

    2d267f4e282ea7e2160701752190d17f

  • SHA1

    ef95d3c4c618963b206a1fe08b2df37b115aebef

  • SHA256

    590df4b2c85d04c69c2919ad8b447a4778ddb34d80bee862da41188214d1d80f

  • SHA512

    f5f8ed73ee3b9f9620aa625f2d6276cd9b8610b8a2be0a59e10adba0f3d38b3d02682f5ff7fc37c85f834e656f6a2606353b46d180196d1a3040e621bf53dee3

  • SSDEEP

    12288:gH1P2w6SZivG9MA7VdielJ/qCxnWlozgDEQMjJVnbVU4klF7PwBA3rVmgj5ln/FK:gH1PF64OAprnIDERjJV6rplLrHbBfRM

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2