Extracted

• • Target

    JaffaCakes118_95da3ebd31c00ef9c5186a0af6796440

  • Size

    752KB

  • MD5

    95da3ebd31c00ef9c5186a0af6796440

  • SHA1

    9e84a580f9af68bc1dd96431223f8d2ce87800d8

  • SHA256

    08f61de703b5962e4339d1c768c0b8fe9591c655992cb68bd9e9176e85a8488d

  • SHA512

    b0647d42c3f32363a7fe0b62298c9a1522fe8bc98be7c97da4b52f7a51bac1a7d32a458e1ddc474d8ed162f672eadaf277f4ed4a296540d672ae8dd47b1e95b6

  • SSDEEP

    12288:IyZQUGtG0ubNtDTP4E9EjX6xvRYoAP//GUF4VkJhwv/Bb14Y0IY8lLAYqKenF18:ISQyHHPV86bYT//5Xqb4Y0QBAY7z

  Score

  10^/10

  discoverydarkcometguest16persistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2