Extracted

• • Target

    4825be39eabdc56bda914c52e7f52c6c_JaffaCakes118

  • Size

    236KB

  • MD5

    4825be39eabdc56bda914c52e7f52c6c

  • SHA1

    ab12d6a3d8953ae717fa1b0057f455007be21c4d

  • SHA256

    6e3ea5466f4c79238477fae18abb2626dabee07cbff1f9a07e8c0de6f9901ac8

  • SHA512

    87a56b0b94a6dc83b8a8268f01d685a40d72a9cf3723908f1e5d4033b7c3ef8df3d5dd8af244dfc553f76e42b9b03f34f37980f04427d7cb27d147f67ce22445

  • SSDEEP

    6144:emDUj24gqU85IzrFA9NfmDuLpNr5NhWudrWDh:eqUj2LkizrzDujVNhWucD

  Score

  10^/10

  darkcometbotpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2