Extracted

• • Target

    JaffaCakes118_c1adf0ba899c7d16676d87b6de8f77aa

  • Size

    751KB

  • MD5

    c1adf0ba899c7d16676d87b6de8f77aa

  • SHA1

    864065137b6f772d33cf6f35c4224bca73944697

  • SHA256

    1fcca160810d613b3c95e10ae327b23476db7925b00d8befc129912ccd4a3b23

  • SHA512

    4315e35e3df6851877c75261106e5230b7b3289c3d2be61b327b7d2388771f27333a3a9b2d0de48cdabd1024f705711fd3f17ae1b0583df4547564d878410de9

  • SSDEEP

    12288:2eSdWyot/0lsBvyMHEFXKDlwgQVy8/0bpuD41AgB1UMcbBV6PCluBKARnmnxCd/7:/Vv/0l0dHENNVynbgDKB19ctWC0vRh1r

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2