Extracted

• • Target

    8e633f7e0ac69398976ef31344512c06_JaffaCakes118

  • Size

    1.6MB

  • MD5

    8e633f7e0ac69398976ef31344512c06

  • SHA1

    8ef2a2101d1484c73576e6fd85cd947e4e979e0e

  • SHA256

    598fa5921807adfac1d6c0d5157edcf32aaa69f472c137e930d2b793a3245445

  • SHA512

    e690aa963e199ed1374ffb9b52aed8a99db6c70235b9c552d3eb55334c09e3012211ded7597dd0a3e73d22fde6204b3dbadfe45b010456b6d349fc5c8c374cf5

  • SSDEEP

    24576:o6wUVWZWGJktFYx1rCwQGjEUJXQZCjFLhiW:WUVWZJJktKx1GJGfPiW

  Score

  10^/10

  darkcometslavediscoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2