Extracted

• • Target

    JaffaCakes118_0b1fab19dd007270cb56fa3220f71712

  • Size

    658KB

  • MD5

    0b1fab19dd007270cb56fa3220f71712

  • SHA1

    ac80ef7bc1b9f6951f398977a8f3f6572e66f9b9

  • SHA256

    52d93be4d86690b5ecd529dd5825151542196dded9b28125f39e92c583f603b8

  • SHA512

    e6b35a11278ab6fa8bb1da49c2c780d05a5c77b8d93ab0baeb431d5d002bac5a2a0a719fdb8f8058780d9d04f384644a3fff35b4a0c23dd7e419b44bb69c87a8

  • SSDEEP

    12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hF:eZ1xuVVjfFoynPaVBUR8f+kN10EB3

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2