Extracted

• • Target

    JaffaCakes118_b990597f7d43d9b5bdbd0af1ed7bf042

  • Size

    680KB

  • MD5

    b990597f7d43d9b5bdbd0af1ed7bf042

  • SHA1

    ee7c950bfec9ef7d11eead62d1c09d4b26e1233d

  • SHA256

    47918ce361896030f596278c4142789af13fad0595f0b1061f5da3ed8b30ad0d

  • SHA512

    8991a503999179236abff78249d39e5105018f6adff12540dfa76883eb2c87de866ca9b940cadcddff643eb0c0da37a128413df1190d5498e2c82cfc0175a528

  • SSDEEP

    12288:U6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhk:pAmBpVKHu0Mu9Xo20VGLVP5

  Score

  10^/10

  darkcometvittimadiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1