Extracted

• • Target

    JaffaCakes118_0cf8200837cf0b24e688473dccf93052

  • Size

    1.1MB

  • MD5

    0cf8200837cf0b24e688473dccf93052

  • SHA1

    197087003ddeda2958de76b0e7ed333e80f25967

  • SHA256

    30bb2e2f29dc5a233be29d20739d866e93f97c3de5617fbd1ba416938f1e63f2

  • SHA512

    a81c08a19058b3eed0c2e5ebb9aa312a82eaf918cc280d9391747efcaadb2ed637fc4540dc82aa1bbedb3e740349b7c9f2e8a2fa44e63c7b51e064099b2052e3

  • SSDEEP

    24576:ToVdK9HL6QN8LrQ5u1oGXBGurYIOaO9MlhvRMQPS:ToVdaHLqZ1JBGu0KlhZS

  Score

  10^/10

  darkcometms-dosdefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2