Extracted

Extracted

• • Target

    JaffaCakes118_94bd603778fd677fb9ae2ba9dea1a90b

  • Size

    1.0MB

  • MD5

    94bd603778fd677fb9ae2ba9dea1a90b

  • SHA1

    a435f6f7fe94e12cfe6127531b04d2de85ed4859

  • SHA256

    de09d1e89d28c805c5e76a55e3de5af8f1b9e2d985bac19a88e42411c2697af6

  • SHA512

    96f4e2aa9fee022b089b5ecfbb917581ecfa8f3553349cc15d4310bed3565ed49ecf574df1939fcefadc3a19fae8ddc8c5ddc9ba79bf4748e9a4ab8b85419d62

  • SSDEEP

    12288:3JIgwDM1afm34GNzONSFm9lAIpeSXLzdMWdSJ1iRraB:3SgYM1alyzhmYsPqWdSbiRraB

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2