Extracted

• • Target

    JaffaCakes118_00abdc488cc96e55dbaeb612f0daf259

  • Size

    709KB

  • MD5

    00abdc488cc96e55dbaeb612f0daf259

  • SHA1

    ff79f1b780454ef48cc7c6357ef400c6b710eed9

  • SHA256

    59abfb3dc2750ecb19cf13cc6b444faef555fe9765f5e7351365f3975c82c645

  • SHA512

    41484904ac2bf1dac7ae2db4a98e86a3962cd1af801caf05680342d07d2ad74fa62b72e0ea3a2ea51067193c50f8b88c1a3d04058df9b710e1173ad15a5162bd

  • SSDEEP

    12288:PoSef2t55VV6im3OWFQ1047B9GUd+u/6N40aozt/4ZwyZibQASvezQMDhKIhBoRZ:Po1Ot/VV6XeWF5yJ6S0aq/k6QASMtKds

  Score

  10^/10

  darkcometwindows_updatedefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2