Extracted

• • Target

    JaffaCakes118_93869c018a3ede86220ff1f99340b5e1

  • Size

    550KB

  • MD5

    93869c018a3ede86220ff1f99340b5e1

  • SHA1

    046cae802afe26f8b52ad5c26bf7b585b7fed288

  • SHA256

    5e4c596fc043671c97a3dd9b8c52e577df180ccfcb43c6b4832b866fd4bc25d8

  • SHA512

    7689b950d1fc92fe79913cbd97f8dae5c8c09feb9f548cb5712a1b9e73ab8dd59a22337f9f29cc45f7910ee7e19086714e2c0ad5bc31578e7fe4c70241ed0de2

  • SSDEEP

    12288:5HUJ4HzMCu3TZHXsHPvGuFNosu1FV9Za9WbSOAp69w:50JuRujtChos0SPp6a

  Score

  10^/10

  darkcometguest16defense_evasiondiscoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Windows security modification

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2