Extracted

• • Target

    3f3beb09e8db0b865e34d3bf4479819f_JaffaCakes118

  • Size

    1.3MB

  • MD5

    3f3beb09e8db0b865e34d3bf4479819f

  • SHA1

    a1b3d9ba90d8c62b2ce49d09ef31bcf496508139

  • SHA256

    fa70c72f7416519343cb4735a521991c0e724f49fb81c252502213b4f5f21f45

  • SHA512

    1373781d3aebc9ce843f62da4779f2b5b0aab1d0737cc873378dbbd54dce0d14db5f315d872ff2e4909dece0e8505d21de2d6f1f0977e3cd879c40bf5739d8b7

  • SSDEEP

    24576:8RrAMRunfFDvZK982TYA77hLrJ7NBNrcZYkhCuRwTszBwbr:wrAMRutbZK9XRPlNwnPRwwC

  Score

  10^/10

  darkcometguest16discoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2