Extracted

• • Target

    69d46bb3e24ed8003e43baa9ffefd1e4_JaffaCakes118

  • Size

    676KB

  • MD5

    69d46bb3e24ed8003e43baa9ffefd1e4

  • SHA1

    72bbf6c2ca6d3da14be6c25873b555f42ca0d4ef

  • SHA256

    3227cae1a471714861d7a829dfad41864a8912d22e31e868f97fe6992d9696f3

  • SHA512

    d7670fb35f303b2b728826928cdfd598294b8d491e1e46b2b66804d8e9eaae8a29e31f5967bfe01cf08d1fafb8766f58c0e37585c117f930980ebbd5b0cbe1f3

  • SSDEEP

    12288:vm361ax3BPhK9Eu7PT9rUmvgDKvN49AL9iwYphpE9bFtx1X9GMc958CvRRHeNKt7:e3sax3DkEmPRhgSmAxipfpibFtx1X9Gl

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2