Extracted

Extracted

• • Target

    JaffaCakes118_85a3a19ca7a5f7b39fab7afc83796954

  • Size

    703KB

  • MD5

    85a3a19ca7a5f7b39fab7afc83796954

  • SHA1

    7e9a371dcfd218bf516e7e2cb8bfbb2ca4393852

  • SHA256

    07f25494ca96661749014ce8a459a3be96b55302fc8d176b291a15f67d9bc7a4

  • SHA512

    cc894e8b352c55bd6d0f60e14482fca26d4f1db1d0ff0dc6a5ceeb94276a8765a18221cf4af37b2e345dbe53b1c7b2c06ee8281d2a82ffa68595eebd0a1f8aec

  • SSDEEP

    12288:T+RKRkS6YRvN4Qxkgp38Em6Duh5Bdzz5PYMXxk3TFwicANfqVO3mdHysuuWjrfZZ:T+RKRkNYRZtp38R357xsBwjUfqg38HyZ

  Score

  10^/10

  darkcometdarkcometdefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2