Extracted

• • Target

    4c6946be02f6b107e93211a0d8bad584_JaffaCakes118

  • Size

    1.1MB

  • MD5

    4c6946be02f6b107e93211a0d8bad584

  • SHA1

    846dd54f489b41643371eb17805a991ae6dbbe01

  • SHA256

    53260799d7f6b1d2777208250c4ccfe93af51647a726244be90a0ae99fd6ee9c

  • SHA512

    ba67767e9448fae6f8032639fd2a6d6340fef70940ba3891017c1b11f304a5255f57c052a79422596cc07ea4184e64500984c78982a2407a5ce110cedb2ada5b

  • SSDEEP

    24576:yDUimI4VelUv3rZeoagbGcuYT/I7w0Z6+TaqjvlVWd7ZQ/H3SQoGc9PL:yDUimyG3rZXGc/gzTaqj9cekD

  Score

  10^/10

  darkcometguest16discoveryevasionrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2