Extracted

• • Target

    a16a87582b1fa805f44465fc76b97446_JaffaCakes118

  • Size

    827KB

  • MD5

    a16a87582b1fa805f44465fc76b97446

  • SHA1

    41af022e92e97254399fd36d68acc845526e4452

  • SHA256

    aade5180b671a74055e5e24f6068c88169fdbdb393d621560613d35b25d6ac85

  • SHA512

    f3fc79f4da694c0212d6919a8e3c4d8e0dc2eb88afb8b0e6a3a1234cf6d2b5385fee8a804f9cb5b437b38cee08e72a2e0eee3f254d540dc127614a48293fe87d

  • SSDEEP

    12288:Y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/xL:MZ1xuVVjfFoynPaVBUR8f+kN10Edx

  Score

  10^/10

  darkcometkingraiderevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2