Extracted

• • Target

    fc5234363831a8cb436a0d7145dce410_JaffaCakes118

  • Size

    640KB

  • MD5

    fc5234363831a8cb436a0d7145dce410

  • SHA1

    ff53edc61ad734404713944b33f6080aa485c94d

  • SHA256

    dd61cab570c1bf03346e2196513d8af18e778464dfe9d53df78d9c4e6da87349

  • SHA512

    bc92f6d4485286a9733c424fabc69a21c917125b6e101133d03d50e95a65d6819e45b197cdfa27066481ca8548bf61fc64d7372f31a2b59c5f9f4e9c4f426dab

  • SSDEEP

    12288:e5Cqbyhaq5kv9lJOps//fBWIcZk5z0uNJfUB0BHJ532jf4e:enlq5YP//fBZgk5zj75Bp5AQe

  Score

  10^/10

  darkcometguest16persistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2