Extracted

• • Target

    185012ebaeb70d74f86e961f028f6753_JaffaCakes118

  • Size

    660KB

  • MD5

    185012ebaeb70d74f86e961f028f6753

  • SHA1

    0530a02de4cffb95e9bf93ac19b189696d285719

  • SHA256

    ca78e05d4d516fa41e9ca622a88865c66297e6a9ec5b366bcd9432e3ed84aff8

  • SHA512

    cfbf6c9349263803a006dbd80040ae4eff64282a9dcdd1bc8ed72511b520b56845e0dd56bf33510d8fe74a7f6363135cd3d133813d22f845d8c6383f5e3ca5b6

  • SSDEEP

    12288:wXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UY:WnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jo

  Score

  10^/10

  darkcometfaggotdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2