Extracted

• • Target

    JaffaCakes118_84872548d241f11d30b0ec3cb37ef889

  • Size

    1.6MB

  • MD5

    84872548d241f11d30b0ec3cb37ef889

  • SHA1

    cd7465a28cbe344f71b806d6ce0d4ee3a17e010f

  • SHA256

    4ea4d839643908a89687a813fbd4b2f6cf181b25bfd308f363c6fc22fd8a6a68

  • SHA512

    9ba00fb2a2758ff0d63420fbd317e6242a066c2c80b008d41931d56d8b06625b550a877153b14beff6094bd9289ae2cef010e52ecba08c0e66cf23d302a5a7ae

  • SSDEEP

    24576:8RmJkcoQricOIQxiZY1iaLWSzWOxnyBLqyfWlo58iAoX62SdHfX9JduvU/X:pJZoQrbTFZY1iaTzcZPf8o58smXducv

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2