Extracted

• • Target

    703d925fc6a6f241142e8f1bb4b6fc32_JaffaCakes118

  • Size

    758KB

  • MD5

    703d925fc6a6f241142e8f1bb4b6fc32

  • SHA1

    fc13ff6c6850e2899279b88c50a3f0171b78c40a

  • SHA256

    b41f5d22552ebb322c71f0eeb7d50092076cf2909aad2b7600b62c2189faf6a5

  • SHA512

    836c5970ce4f62ca201141a38188c072779d154845b5ac11ea4b3b0cb7ced7634d2f6755623a4f3dfb58a641bdff0c146b07d5f3755bdecc1b9e9f860a1c7c38

  • SSDEEP

    12288:uXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U2:wnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jm

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2