Extracted

• • Target

    JaffaCakes118_97fa35487115e8da157cdc4dad881ae0

  • Size

    754KB

  • MD5

    97fa35487115e8da157cdc4dad881ae0

  • SHA1

    16e3b24c4683f215bf7379736c023ee5ff69513f

  • SHA256

    88e456c8868b446aa5eef3be893e0c842eeda9e2a888b9a2a3d343048caf8772

  • SHA512

    026e9bebd5bf473b3c2fc204b2405392f76f05a9379bf279baa6f9647e6c3980141a84163acda5b51ac53ade89cf2e76ae3b1bb7719e151b7d91e0c7d0c169e4

  • SSDEEP

    12288:5aAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuNK3oK:UAEE3uBDhynCylQgi63O9+VuN

  Score

  10^/10

  darkcometdefaultdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2