Extracted

• • Target

    JaffaCakes118_06fae65926c267cd8aecdc255566e350

  • Size

    1020KB

  • MD5

    06fae65926c267cd8aecdc255566e350

  • SHA1

    5d42c742c9cc88f95dd73cbe35b519c8dd775a84

  • SHA256

    5e457722f87508ff07faeaf226e6e48565d11eb0e5b1931f870855a27799e779

  • SHA512

    cb9bd4d855966948f36b7210afaed2686be0fcc5e57100a1024b73cf4eaafa36f68969f5a849670ff23e9e7f646155c0398a46874d5ec26565b5b90685a6d1b9

  • SSDEEP

    24576:YZ1xuVVjfFoynPaVBUR8f+kN10EB5LV1Lqtzwgz:IQDgok30yL2t8Q

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2