Extracted

• • Target

    eb6f77a1338144f6c63a55ed5e8a79c0_JaffaCakes118

  • Size

    810KB

  • MD5

    eb6f77a1338144f6c63a55ed5e8a79c0

  • SHA1

    eb3fd0679186ee458f24af93e95ccd5f504c559b

  • SHA256

    3390ed4ef3a99e04b9eff52e787a72fa1e9afb59eb93895344b577461d373e25

  • SHA512

    032dcd5ee33f9e67c9963b2a374116a0ad8191cce0fb750e9f9e73ff98dd34fa71351e7a0e99ab57e45a57ea15aa130e3bd0f2f696593ceed0d5931d466401f3

  • SSDEEP

    24576:xWwHivRnJlg5ngEn2kHj+Z0BW2/7nRn1Bk:xWwmRnJl+gEnVjwiZk

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2