Extracted

• • Target

    JaffaCakes118_ecbd41a1d0f5de265a991f525da79f07

  • Size

    267KB

  • MD5

    ecbd41a1d0f5de265a991f525da79f07

  • SHA1

    dd5df2dc0d31028b4e321bb983d7865b4b0a085e

  • SHA256

    85055c8c07087fba61b509d6985102e9689c61e3a281fa9d73618cc49c1b5893

  • SHA512

    c04512764da617c9f92bd4c653cc2f3056ad767e4f3efb32e11a238c6c4562e850e0fabfe7f8d300bf80e5bb0112a431b881929c4f94fc3070927804a41fb5ff

  • SSDEEP

    6144:njlhvTTrl/iniEYle61BLyfhmJ3OJRcNBG:njrv/rgifE61BcIkKBG

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2