Extracted

• • Target

    JaffaCakes118_89a5294073212334de67961067c52248

  • Size

    268KB

  • MD5

    89a5294073212334de67961067c52248

  • SHA1

    8fcbbc37cd911fe4b5178dc7077bdd6f33e0589e

  • SHA256

    147fb04b4ddd42ba65754143e6e3bd0b02381023a3145df2e58593d1ed393034

  • SHA512

    15e357ca251a63b2efe9f82943c0fc31c9e360e1863df1fb6e2df994426aea1537ea56e7bfc69c7a8d6bff715ced044093184cfe6fa75d2c78895fdc1f24e48f

  • SSDEEP

    6144:PocMD9L6Ro5oso1IwJs3mb6plI/7SCNG:PtMDF6RomTGwJd64uCA

  Score

  10^/10

  darkcometîñæýdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2