Extracted

• • Target

    67de7126bce1376edeb487ed34d6892b_JaffaCakes118

  • Size

    450KB

  • MD5

    67de7126bce1376edeb487ed34d6892b

  • SHA1

    901df5eeeba0d5d6774b646599ea98c430970e4b

  • SHA256

    3178ebb16fffc765f2f69266a92d10f1f996a51e7ed8a27482a9cfebdca0b567

  • SHA512

    236dd13642b3e79396aefb05f40edceb5c599c30d1d2c138193558853fc5cc12d9ad1bc6e13ee42b7ad9ddd38f2f47387aeafd7f616c743274b84d29a56a3b6f

  • SSDEEP

    12288:+MnBsky90bVpotSvGIUTXmxk7wc9d8yDCb:rsky2potS+BTXgVc9dD

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2