Extracted

• • Target

    JaffaCakes118_6cb155cfa94207060ff03fda501e1576

  • Size

    658KB

  • MD5

    6cb155cfa94207060ff03fda501e1576

  • SHA1

    8d2f2cf7718d9ee9985553a8c750051685591128

  • SHA256

    89c5ed28a7eaf9682714246836f197846599b6f7d237874debcd0bd6e17741fd

  • SHA512

    e0a34e3222f467efff5dabacb5c72fbc4fda19865c67c12b0bed366eb8be888b69e385b00c2f138dfea20aeb3328737a52a9e701de921c565331f2b630f90d8d

  • SSDEEP

    12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hu:eZ1xuVVjfFoynPaVBUR8f+kN10EBw

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2