Extracted

• • Target

    JaffaCakes118_2eeaf2d591f25bd28afc73c07007c0e5

  • Size

    646KB

  • MD5

    2eeaf2d591f25bd28afc73c07007c0e5

  • SHA1

    4bc7423fdbf1afee6d33309fe2d30e8cc74d575f

  • SHA256

    1c06bb698f350ed44c2063dfd696153010bf9889f2f14a6cccce85f87f2d76be

  • SHA512

    90523c6341f6ce30d891986e5883f770091a4552845206d17bc45e8cc24f0aa934c683f33848d0b4edc065b3d45b3f84d6b7b37b0f457fe45dfdea0370c2aea4

  • SSDEEP

    12288:48UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixA:RUKoN0bUxgGa/pfBHDb+y1HgZC

  Score

  10^/10

  darkcometpc guarddiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2