Extracted

• • Target

    fe20fabfd161f2b0626f59f87668181c_JaffaCakes118

  • Size

    795KB

  • MD5

    fe20fabfd161f2b0626f59f87668181c

  • SHA1

    8e11a8cfae176127eade4d6067e97ecd64328e17

  • SHA256

    15430685b859b3a37e6fe88dc5ea8a0e2c373ebf3e07501e9bbd8bebd800305c

  • SHA512

    cd36eff3a23da54105c383e0abfa8cd937aa5796347b83c6c9e45b5c002309c3eac2d616063454949ce1d3693949123c4e0978027e4c505cf93400e6f2388d77

  • SSDEEP

    24576:jnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJfprz4Mduc+:zELbVMTrOq494Mq

  Score

  10^/10

  darkcometfuddiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2