Extracted

• • Target

    JaffaCakes118_929f77a47a4a33455ccdb7366ef0ff98

  • Size

    899KB

  • MD5

    929f77a47a4a33455ccdb7366ef0ff98

  • SHA1

    38b8140d139c212b12ac4fbef64a339da3a50af9

  • SHA256

    cca77ef16e89bff979f6abf9b435cf7c433f664f6003648a4645530c37a857a4

  • SHA512

    8cab77bc38be2aca1ded368a3ffac1f56d21351ea24c0271daf0b11d833d0e120c9a2be9061248aa951cb268efdf7b42aa157bc54415e7f6154475ad22835488

  • SSDEEP

    12288:EdQyETqOIG8u8IaPowniyjkRmFm9fMVa5t3OYyd0kf5jkJxL1XWkGl4IsGikcDho:EdQuOIG8gsTo3N3OYif5jOWkwtsBxmH

  Score

  10^/10

  darkcometo0ziildiscoverypersistencerattrojandefense_evasion

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2