Extracted

• • Target

    a72f0a344892c234f13a5d3b7d80e32d_JaffaCakes118

  • Size

    658KB

  • MD5

    a72f0a344892c234f13a5d3b7d80e32d

  • SHA1

    d9151607c6203902b04e09cd0482ad6a8136d5f4

  • SHA256

    e6f6e9187b8471bfef50ecd7bce4356ade32dc1a166f2681969cdbea0b5a8ab3

  • SHA512

    cbcf9f61ee405345452bc928357a2ad4a597b218afde2ef584771c62418fb38966e06915617ad4adbd4e345757375b357b438a1cf806b496795cebfa02bd24f4

  • SSDEEP

    12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hw:qZ1xuVVjfFoynPaVBUR8f+kN10EBC

  Score

  10^/10

  darkcometazath0tdiscoveryevasionrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan
  behavioral1behavioral2