Extracted

• • Target
    JaffaCakes118_152451ed80e20ca0a422bfb0d6e29da5
  • Size 735KB
  • SHA256 46c06d98d962a5208987890ede295c3169c44ebc988a99604a4aa6c6df3011f2
  • MD5 152451ed80e20ca0a422bfb0d6e29da5
  • SHA1 53b7e19ad06c935f4422857903b52dcd5786363e
  • SHA512 6ce756d2766eda3d6852d65aeddcc99a2e5452a65383a5a60b2c0064befcd5bcf74ee227173b42977e5b14a4594be6ac3e55b5581fcd0173fc4418bd73ec173c
  • SSDEEP 12288:b9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFYuMU31:ViBIGkbxqEcjsWiDxguehC2SoMUF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkcometspeaddefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2