Extracted

• • Target

    JaffaCakes118_8298726dbf7d0470e43921b5414bb42b

  • Size

    1.2MB

  • MD5

    8298726dbf7d0470e43921b5414bb42b

  • SHA1

    4170533ffe965c64805defee5d5a73ed5035dbdc

  • SHA256

    cd3f381433dd4886d5f3f97e5fe533892607e7af5e2b71a44169f13e66860356

  • SHA512

    52209827e23a9903f9016a40d9ca443ceec3d5fa6d8f62b04d8157f3af48421b0259ff752adb51d00bde0ed0197640eea65b96734de4e29b0096d461a82e9bd4

  • SSDEEP

    24576:aFEL4p+88d9iyeQWGjiOua2FGixTw2m3rYtQK/cRgOnmq9g6Xu:F4p+xkQNiOuTGYXNtrcOU7m6+

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2