Extracted

• • Target

    JaffaCakes118_6a89835db18e4e20978b80beaadfe910

  • Size

    662KB

  • MD5

    6a89835db18e4e20978b80beaadfe910

  • SHA1

    e3ffa312c2e0457c821433507f546f91603de41a

  • SHA256

    8d7f410cf32ef0aa06537afc156b6cff821d6fe6422fe68b87491890f64d2aa0

  • SHA512

    51dac9306c1099cbef45baf8b5327d0c89c5658ed7e5b5641d300cba2411eddc05aad4681a2f1a1e61cb6fb0bba4d1566c841293d4665078bc3a7085fbb4af36

  • SSDEEP

    12288:I3OpvNW4a76S/Ddon/m09bbYlIaaMcE2YGhq3vo1RnfAvIESJgoE26yc/RS:+OA4aWNn/m09fKIaaBEtWq3A1Ov8Jgb0

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2