Extracted

• • Target

    c0261de6f8482d655c503f1010dc8896_JaffaCakes118

  • Size

    690KB

  • MD5

    c0261de6f8482d655c503f1010dc8896

  • SHA1

    093b6680099771887c91b9b7e8bd1bb9d0900cff

  • SHA256

    b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8

  • SHA512

    1cf854af7421f4ee673eb31de2ddd4102b58abc835a381ff4628e6bb50d313342a7656e77884eca0626d22afaaa643a32d8a0d5de1d88c16aff75bd75fcdee19

  • SSDEEP

    12288:t9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hq3:HZ1xuVVjfFoynPaVBUR8f+kN10EBW

  Score

  10^/10

  darkcometguest16discoveryevasionrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan
  behavioral1behavioral2