Extracted

• • Target

    JaffaCakes118_6d818dc8eac5696f3169d335aa12db90

  • Size

    756KB

  • MD5

    6d818dc8eac5696f3169d335aa12db90

  • SHA1

    add3b0edfc541372fbf4181ea78483de04c21c7d

  • SHA256

    3e2b70491923a6e129272cb9a61a16034c9775ef0c4602a06737dd4035f19df3

  • SHA512

    acecbf393b2029985a166ed938230f201ff33b01f35e01af42762289d1651d91b12d63f63c92b1315ec81eac5a91c007d32a3d81b9e18efbb181e4540caf42ff

  • SSDEEP

    12288:o9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hiGC:cZ1xuVVjfFoynPaVBUR8f+kN10EBJC

  Score

  10^/10

  darkcometnewhackdiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    evasiontrojan

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2