Extracted

• • Target

    f46c01edc415cb7eac960368a1f1e2f2_JaffaCakes118

  • Size

    834KB

  • MD5

    f46c01edc415cb7eac960368a1f1e2f2

  • SHA1

    afcb4f303a4cf5d70fbd4714abae58a5ebbea663

  • SHA256

    7c5aa3941d777c085c3d936fe8a4a4644210b0ec48267fc62ba2a044ed4eeb21

  • SHA512

    fc9aefb22563dd616626a0813b5d40ba3a8a1da7bc53e3bc6268280dd095f20bb194671520210fde55045012582cd7bf429f967a216d11441a8f9257fd9fe8f9

  • SSDEEP

    24576:tMcKVmKIeOwO5U0/hV7kOp2x1XiQ+NzPwW56Zz4bd3c:ScKVmKIenqU0/v7kOp2x1XiQsjn6F4b

  Score

  10^/10

  darkcometwindowspersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2