Extracted

Extracted

• • Target

    JaffaCakes118_3463cee1547a94d1b1cb953907ff986c

  • Size

    5.3MB

  • MD5

    3463cee1547a94d1b1cb953907ff986c

  • SHA1

    357e395eeffe902743d6bdfcd54ebd4989ca60c3

  • SHA256

    00fd3ebe05097e9d7126bb0c341b45b7df3233c37d00350bb5da5de07caeebed

  • SHA512

    744f61ee3f85a1ae453a6cf0eb315eb44cb10ad16b411bd59c16bfbccd5b509aca37ff7e2eb38b4076ec3ba78df031cb1add05ec127bfe834f625e2baf3cac42

  • SSDEEP

    98304:802MvuPcO8xoklmbET3aKE9cWdaMfoB5TF6i:801mPcOUpkEuZfQRB

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2