Extracted

• • Target

    JaffaCakes118_0c3d733395eb6e9f0b6b562425602936

  • Size

    687KB

  • MD5

    0c3d733395eb6e9f0b6b562425602936

  • SHA1

    0dae228edead796d90e8d0a4e616b48878afed94

  • SHA256

    ee9b13757d5cedd0fb8d5777fa80585f9ff16dd4ff828e2151117453e8b24d22

  • SHA512

    26b8d9468a530a0c6b9bbb51058b6502672a5bce909bb552403e0055fcfd42d46565e40c8afbc58a1f6058f9bc8ce4d0d8192784eeea659d4eadd419a4a797a0

  • SSDEEP

    12288:fWze3Uyp278C1nS45eol2I7LQmV5ceNd0l9kgH0hw0jTC85FKwMyLeDSAwJJr:fWy39p278U0ol2+LrceNd0l9k5fjTC8f

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    defense_evasiontrojan

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2