Extracted

• • Target

    JaffaCakes118_6924999b503cf3ffdd3aae6c74903a80

  • Size

    658KB

  • MD5

    6924999b503cf3ffdd3aae6c74903a80

  • SHA1

    d92b24728a6aa81dc714869567a7f0af2b3d65ae

  • SHA256

    aa03897f125f368df295744f05c713067a03166386167c837341561bb4344c2a

  • SHA512

    6b9d4b673edfe8da3b6eccb7ffa2beef08549222e584e904344f042387414ae64d9a291bfab2d69b99d38c693a38e3afee871efedae221d1ee38afed49cbff4d

  • SSDEEP

    12288:O9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFG:aiBIGkbxqEcjsWiDxguehC2SJ

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2