Extracted

• • Target

    ea3d9a744be6d0f17244447058ef5e00_JaffaCakes118

  • Size

    684KB

  • MD5

    ea3d9a744be6d0f17244447058ef5e00

  • SHA1

    a13b28b784070ae943adfa51285073bdb5d005dc

  • SHA256

    dc561c8b1084253ebe75538353ad115963a6c26bf4b02bce516d70ef9ef09bf6

  • SHA512

    28bf0771f2d423d31769f382d81c4058730e38cbd209eaad34342a6598b0f961da2dcdb59d9e0db3999354c471a7669abee2117d111fd600d0a146d0db1290ae

  • SSDEEP

    12288:eeS04QhRKKkoTAWuRRxUqbQPlCEXNuBu3Fxfa8XTMfWK8FpPxkk2f15ARISPu+gP:dl4hToTAWuRRBbQdpBzfaCOYukWviISw

  Score

  10^/10

  darkcometmodiloaderkaspersky anti-virusdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2