Extracted

• • Target

    JaffaCakes118_afe42016a936e490b4ac1b6d97131fe7

  • Size

    811KB

  • MD5

    afe42016a936e490b4ac1b6d97131fe7

  • SHA1

    22b8ef5c7c6fb65b5bc8df1ad93fb498fc4c53fc

  • SHA256

    273302cd9a562a7d510247c1fb5142320f807aaf302f9c2c85b2d1de50bd54ac

  • SHA512

    91f5ea8490b675c3e4e1fc5d0c46eae685fa28eaaf3df26721b4035ccc6dff78f0cfb16906cc58f6468d8e11d84219f9dd889127d52227a8693511d77b60d5a7

  • SSDEEP

    12288:baAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdEFIIhII:uAEENIq8XwyVPQclDq/+WnpsS

  Score

  10^/10

  darkcomettestdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1