Extracted

• • Target

    6d07952bb7955a0e3843ad6682ab44fc_JaffaCakes118

  • Size

    853KB

  • MD5

    6d07952bb7955a0e3843ad6682ab44fc

  • SHA1

    1ee6ae4d8c17cda36cbeee34748d6fb56080ba01

  • SHA256

    284a8d0f09ac22db469439e098d0bc6706bc96c7cf68ccbb5ef35534b62ff821

  • SHA512

    2b4ab8fc089ab29275409fc0583a4b02808ec584ee3a19e3c302583c9870bd137eb57e71e48661e5fd9f5fda8b626e102c3b910afeff580e7eb228fc393ad7d4

  • SSDEEP

    12288:1tDG20jqd59c8av2ueqYsYsyIDnX3ZUUS+A35Zg1hqizLXICiii:1tD4jkTcR2u9lLDnXuTV35O1hqCkCfi

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2