Extracted

Extracted

• • Target

    JaffaCakes118_96a686bb248a355f9a720d9bf61ef064

  • Size

    944KB

  • MD5

    96a686bb248a355f9a720d9bf61ef064

  • SHA1

    b2a5177dfcdaa530c80f90f941de179ee2fb7b13

  • SHA256

    6738adf5533e75a138acd4a3529e06c684358e6357ed35032e2754f410bcb0fd

  • SHA512

    9f620190913834951e0374975554d15d00b596c15a9580fd81ad3301b76ba9387ceca3a7d261436d47178f848432a5e612584ab2f20a4d9aa4035f73ac0509a2

  • SSDEEP

    24576:hI1FoXBnpw8bzRhObDkvEbSDKC2UmKaHZfKYYPi:hMYBny0zD0DkvG8mKQCYY6

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2