Extracted

• • Target

    ae3fcb2e6d50c16613a9306353aaa603_JaffaCakes118

  • Size

    660KB

  • MD5

    ae3fcb2e6d50c16613a9306353aaa603

  • SHA1

    79475e0ec5962172209c5a9108b1d0114b57bd50

  • SHA256

    86d2b6ac5a4d58a93f4074ad46b66d39ec7807bcde60f851e216ab596e80f5e5

  • SHA512

    966b491c1e6ab2c150bb217c9df2b5b8b1fbc6132a7d56e073e1e17002d24f1a9e214fbf8ea1766245996e925e1ba231534ae2756ee7e1df09f15b1eed1e2961

  • SSDEEP

    12288:gXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U9:mnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JN

  Score

  10^/10

  darkcometqwdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2