Extracted

• • Target

    5aaa757bb1158c535dc9d0dc2ceb5c6e_JaffaCakes118

  • Size

    1.4MB

  • MD5

    5aaa757bb1158c535dc9d0dc2ceb5c6e

  • SHA1

    64d6a07b83fea91ff896d385bbadc71e7329200b

  • SHA256

    be38cb3c0c4e26338bcc25159f502d2931808a2e316acc0717afdc7d0f4ad3cd

  • SHA512

    621786e5ed3d50aee265b0af25e34999a1c12fc286bf56f4ef6f9104815dce934203a5a4f91d70a2b6e2e19b0b661ace176f0a53d066a556a2ba1c6b3418e039

  • SSDEEP

    24576:ZYOYRzRTPDDP1G20kJ795e2Jc5eJ0dpnMiQi6U6lCTQvzR5:mldTPDFspnBHOOQbR5

  Score

  10^/10

  darkcometurgediscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2