Extracted

• • Target

    JaffaCakes118_af78729c33017ef7ff7455db34c542ac

  • Size

    872KB

  • MD5

    af78729c33017ef7ff7455db34c542ac

  • SHA1

    563a10172a1d0fbd6d78282432693f9d5b5d3584

  • SHA256

    1396a0b6696ab2c0df67e111ca920ebdaaed066a76c88d31dcc7eef4ab3bfcbe

  • SHA512

    6764bcb0def2594b0ce0fe7d9f2e37ae051e3002673bbfe2a5b557b582b7fbe4e7a8796c6fd39fde0d53153f6ca6016f8064b0bf3851c07df490463b19191139

  • SSDEEP

    24576:12sr/p9rBIOR1ML/AbT+BbcmRKSZX/9npoRs:Vrx9rXLM8bT+BbcmRJx/9poRs

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1