Extracted

• • Target

    8f58c94ece1bace4e3eac74c51950fcc_JaffaCakes118

  • Size

    886KB

  • MD5

    8f58c94ece1bace4e3eac74c51950fcc

  • SHA1

    a95f0b844701f05054b7382be6aa7888498a2626

  • SHA256

    d6df64bbc9873e60a38dfb6ff3fe0a3d0763167e07b84279ba328860d48cd4e9

  • SHA512

    dfaafd564837b4f2466b0215de21234c8ac82057ebec19fa2479b590fb774aa361ca2dc2e1a0142599ae302ddfb2b9dffb68750192912647f29949684bf4a862

  • SSDEEP

    12288:xXZFfk9Qc45ejXv1LvwrNIlcH/OohtdtYTZqgA9Yrs5WCTj4LXynXyLLlQ:Vvk9Q9er9jw56cH/Ntdt/gcY45WC/rE

  Score

  10^/10

  darkcomettorrentdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Molebox Virtualization software

    Detects file using Molebox Virtualization software.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2