Extracted

• • Target

    JaffaCakes118_231ac82d651b591edd3b5939b7d9029a

  • Size

    760KB

  • MD5

    231ac82d651b591edd3b5939b7d9029a

  • SHA1

    dfa6fd19622e1902366062e00a9d2f742a874372

  • SHA256

    c661883ef7c738f2b9a2928abd0c458ffe22c23f88c8b03dd5d8b336df03e081

  • SHA512

    6dd4afd03ba250cbfe8a75011ee56b5b3a99c81d98033c448f2c84d9a21d16953f100d2c887ea7b6ac55210086dd8f5455e496344e62b921906549afe0f2e2e7

  • SSDEEP

    12288:I3OpvNW4a76S/Ddon/m09bbYlIaaMcE2YGhq3vo1RnfAvIESJgoE26yc/RcbHhwS:+OA4aWNn/m09fKIaaBEtWq3A1Ov8JgbI

  Score

  10^/10

  darkcometonediscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2