Extracted

• • Target

    240bd2cbc83c7295112bc8f3978604f9_JaffaCakes118

  • Size

    758KB

  • MD5

    240bd2cbc83c7295112bc8f3978604f9

  • SHA1

    8315d222710dd4f18da6b453cbd944b85083e197

  • SHA256

    cbbcee9aaf3ea06493f8f6ddaf965b872d9fce8fb0b5853f2454ff62f10c5122

  • SHA512

    8aa0b34c6b6c9d3d74171285abc0ddaba056c3dcf11efafb779afa4780e42d046d117164d871b7bc7f29991fd5a9cf70032f8e4fc012975ffa0816a51c57aedd

  • SSDEEP

    12288:VXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Ui:pnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JS

  Score

  10^/10

  darkcometguest17persistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2