Extracted

• • Target

    JaffaCakes118_0853ce9cf7687d448b1a36911a6f6f88

  • Size

    827KB

  • MD5

    0853ce9cf7687d448b1a36911a6f6f88

  • SHA1

    2437e3fc9c004641e93214baf3b56842e531e877

  • SHA256

    de8cbea03deba03ac845b1f7d6d86594c201de88fad685f6b8c8c5d021c2d277

  • SHA512

    da25f5641fc07f955a98dc099d86ec156352e250aff10e9fddba9735b6f14e0dfef9650a78959a90ea51740af9b6535632e6a05861ae7ac3c20aee4e66231b15

  • SSDEEP

    24576:siys4aTCBlDnSzJLbT6EorIpkG0oZJnmg2:siysu2JnT6hG0+2

  Score

  10^/10

  darkcometguest1discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2