Extracted

• • Target

    f11d166a763bea0892353e76bd5fc5bc_JaffaCakes118

  • Size

    354KB

  • MD5

    f11d166a763bea0892353e76bd5fc5bc

  • SHA1

    e25207ff69272ca1bd79bb5ee7c418106d4b6863

  • SHA256

    dd3a2e3a7e386d6c2d63d463240ec44b3a7885a9068a3b94c0a7a92a431ebaf1

  • SHA512

    f5bb0a73e9114c5086bc2e8177505f693b2678824c0b217c3fab70cc528ad735cb91154d070d6b3903f6a8bf58eebe9f8c203267b18d15f77a803bc66f959ca5

  • SSDEEP

    6144:Y1bYRD9dqm9+PuG/8dQiDJT8xhxWO5Y9G69R3KBQhrfhhREFL7OhTEZaxQeSzPry:YRYRDreuHdQiMhxDY9GmR3v5fhPEsVaE

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2