Extracted

• • Target

    JaffaCakes118_ba7109bab9ec6265539b89142e426d83

  • Size

    286KB

  • MD5

    ba7109bab9ec6265539b89142e426d83

  • SHA1

    60e6a9c21eeb1e80572cb6798c7cc0091489ca46

  • SHA256

    3a5c2142b63d3b4058a083d8a0c8d624b46f492f7c280baeee14bd65656b646b

  • SHA512

    5dc9248f5e80bebe75716e5876e42740a8322eea3dd970094d02df2b3cf1971569947c6a0308a87b13777a2ea68bfdc0d8039136baf0910ca50ad55944f60a87

  • SSDEEP

    3072:q3rAsZQCByAxj0v3VGOcZKepLVIfdpxNqaxKZLoZzDu0Ly7Q9+Rjw4bkZbSpsOoC:lVvvFIdhUd8QxW7zRjrbk+sOYSUQF

  Score

  10^/10

  darkcometprv1discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2