Extracted

• • Target

    JaffaCakes118_1d2479184b2a686ebbc21550860d9a00

  • Size

    658KB

  • MD5

    1d2479184b2a686ebbc21550860d9a00

  • SHA1

    d86d5803c4a3ac545d926522b64068bec6ee999d

  • SHA256

    be5ed0d0ec7cbf1776fa045cf5b84e5d553b86c40b2fc24c3fe4c9cdea12d78a

  • SHA512

    1912f0460dff87a0b6fbe37f4b849d4f8dfaf0c5714a98cc512fdb25df4a5d5fc65203d8b77da75300271b927276e2a76232c923a65de59a6b81fc12f77df8fa

  • SSDEEP

    12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hY:eZ1xuVVjfFoynPaVBUR8f+kN10EBO

  Score

  10^/10

  darkcometguestdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2