Extracted

• • Target

    JaffaCakes118_612e04480b753f9dd759ce7974b91172

  • Size

    730KB

  • MD5

    612e04480b753f9dd759ce7974b91172

  • SHA1

    7bb252bc61263ffce8e814522493893c958d06c9

  • SHA256

    8347c833c3a97bfb714897815f3c46516fac0c266e8ef044875aac5e9975a8a1

  • SHA512

    c9c4e3566fdf5d1180fc169571e12d6e3f1e4d676d96a98cadbec0b57daa5ba45feee2df8e7001934eb631d717d7de41b390246fcacb56d53c2bcbc5e8fc1833

  • SSDEEP

    12288:u9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hyaBvCJj:6Z1xuVVjfFoynPaVBUR8f+kN10EBlhc

  Score

  10^/10

  darkcometinvadeddiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2