Extracted

• • Target

    466cd29dbcc76fb63609b3578b63c695_JaffaCakes118

  • Size

    807KB

  • MD5

    466cd29dbcc76fb63609b3578b63c695

  • SHA1

    723f7940e3869a384c5db52f700595958584e939

  • SHA256

    c6ed4606ac8b52c0e967f392055dce9f5c49f98aabee9a6686048a703354d2b6

  • SHA512

    fb03357655e2b37bb4e32a345c3d76c5f0bb58dd91592bd9ca97dea7bffea76f7271b970f45f3db39d9c1cd62e9ae3d6076bf571359eccd517b8d16cf4852491

  • SSDEEP

    24576:vHBhcJucI7T/ku+DaLtqHNnspezVpX5PrS:ZNT/ku+2LEtnGKVBJu

  Score

  10^/10

  darkcometl0l-th3b34tevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2