Extracted

• • Target

    JaffaCakes118_25c89e1e3471b44531eb12561cc6f892

  • Size

    756KB

  • MD5

    25c89e1e3471b44531eb12561cc6f892

  • SHA1

    d57b33f7f99ceb1c52d3da3f02ddf30ddaa60ffb

  • SHA256

    3e2c839c79e413ed87a779b09fa42276c0375972b8c6f8eafa7013e04126675e

  • SHA512

    04943bf114cb827b026f1915f04d6ff82104c127eb769903062e9c085eea61721bfc8f82f5a6780435bf0cbaebf692d0caf71025084a47d73b48bd1a46642980

  • SSDEEP

    12288:I9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/heGq:8Z1xuVVjfFoynPaVBUR8f+kN10EB9q

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2