Extracted

Extracted

• • Target

    JaffaCakes118_31f58638a0a7fa73b994e499a535a122

  • Size

    1011KB

  • MD5

    31f58638a0a7fa73b994e499a535a122

  • SHA1

    8e746e1f5ed2cf7a597a3f8aae807b982f314b3a

  • SHA256

    2decd81550f4d79ec936cf7587caf057782c98b4147b604084aa73d599a04a3d

  • SHA512

    c824e522671b70269fdecb96fa46d6ce6ff1221b5e0135f85f68735080a5b0898ae47ad346a08776310c602aeb10c230f4de5c60b07f65c3d344865c47b7eb39

  • SSDEEP

    24576:BvOTggIRfmQX3zRYC6FVZPv+FWe4Ys/E:VjYlDZ3+UT/E

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2