Extracted

• • Target

    496b3e5f673f5407ea4a55c1d17736a5_JaffaCakes118

  • Size

    1.0MB

  • MD5

    496b3e5f673f5407ea4a55c1d17736a5

  • SHA1

    be6b5eae60384d6c99011f003a277c0c3031bc80

  • SHA256

    3e6b574ae73a735fde06db712e8c7f2d767e14acba572942ff4b9a2553c557b2

  • SHA512

    2531dc8457f9001a73b451a9fd3a0f93e56fcc77114f14a13c7ddfcb70fdab3b95c50cdeb1c8dd0fc2b8889347d022e4abd13512b077f5daae12449b0ea487d1

  • SSDEEP

    12288:K9DlmwWmfA71dcgvP7OimiRTH54nqosMbkf8Jyiebft56QcC4Ty089SI3l87d4pZ:0NA1xFRNJo7PU5IPalY7TB4EMj8B

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2