Extracted

• • Target

    JaffaCakes118_5fd6f993536d8122c4589412255cd9fd4e8a08ac51cace2675f5babf04743190

  • Size

    658KB

  • MD5

    76d4c9d90b0f5da4c1e73f9557f5573e

  • SHA1

    eb547eb3df5d009b831eb46dafbc8950fa24e053

  • SHA256

    5fd6f993536d8122c4589412255cd9fd4e8a08ac51cace2675f5babf04743190

  • SHA512

    23f35541e9f08cee407f76af5ae590c3bcbc8f871aec1a840ef71d01eefc5b5ef719cc6caf28aae5cd8f8a41474797346b145137503368555dbc9e64c470cffd

  • SSDEEP

    12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h+:+Z1xuVVjfFoynPaVBUR8f+kN10EBs

  Score

  10^/10

  darkcometasdasddiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2