Extracted

• • Target

    40829cf20ef915ac8487f3d134fbf456_JaffaCakes118

  • Size

    333KB

  • MD5

    40829cf20ef915ac8487f3d134fbf456

  • SHA1

    5a6b3e6911d804c89bd67eb9e6f2b522cfb44b65

  • SHA256

    285550ddfefd50bc0d6ad5494f8e7417c9a6a48d6f09c16db681fa4a9d799fa2

  • SHA512

    fb77c9ed7b7e42e157a732cb729297233106cd19e16f1b7533f5c81af793178675923f8bc7c1d5100d2526282fc4de1702274d11053ecbf1ee87e8180d70d887

  • SSDEEP

    6144:bMMWJH007FoGoyy3GSrsM/XII6aN2Z1sVd+SK6brDgNqpbn+UnCT7m4OhUcV9Ui:2JH0NGoyYYB7Z10s+DgNqR+37m4Oci

  Score

  10^/10

  darkcometcleanevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2