Extracted

• • Target

    JaffaCakes118_30c9addd17a7514f68f16f841156aed2

  • Size

    712KB

  • MD5

    30c9addd17a7514f68f16f841156aed2

  • SHA1

    ac93026a45b6cc341a5849058151894f524d37d9

  • SHA256

    1088a3f97b111ef802df47593fa71f0737c2b908568b6e6c34b31ca0d923dd20

  • SHA512

    f2ea108d5e973c25f49c7e0b5fc9aba08c4cfece24083a9e5ff92b4c4aa86a8dc9cde016dacc40f3552052decb758e9aa7e9d3880da918426a977b9ef7013765

  • SSDEEP

    12288:wfDh89H6hn3VbjpKJ/6GvmlnSSA793h/v6x4Rfc4obOY9x3qnJ00jaAuKQPqhW1l:C8V23ZmauhXkjRbOIW5QHgCo8ZlYg

  Score

  10^/10

  darkcometnetloaddiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2