Extracted

• • Target

    fbec7cabbdc37ab96d398f3bab2e143d_JaffaCakes118

  • Size

    658KB

  • MD5

    fbec7cabbdc37ab96d398f3bab2e143d

  • SHA1

    58b14d00f2c0437d658e8c9e29d11e619eb18738

  • SHA256

    c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30

  • SHA512

    cdf3f9a4478a93c5a1c3952fb35640b9e53638ecbd732beb1c47d4a80cae18850a8d1fde36f62bd8163fb9b33ec5de19ba8670fb7b174625a39b60fb6a1b7dd0

  • SSDEEP

    12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hU:eZ1xuVVjfFoynPaVBUR8f+kN10EBO

  Score

  10^/10

  darkcometvitimapersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2