Extracted

• • Target

    a99d77243ea9f567c49d556fa4c3f916_JaffaCakes118

  • Size

    721KB

  • MD5

    a99d77243ea9f567c49d556fa4c3f916

  • SHA1

    376ede553fa9a0ebbcf7b3855602e643e74b179c

  • SHA256

    916cc328fc7cbef3a566267f37145ae0a60568108c0960e93f87d7448475f69c

  • SHA512

    1bfb249850b7325cf6afe63e85134917731f5c28394b5839b394f147c0b4f7595d03e7a4d52a9180e211533d55a1d77ea6ceca0d8fb9b6b7c4eddca80b751e23

  • SSDEEP

    12288:1egRJeugJm952LBXcru+kLbUbHNLWt3Jpgbp5xKMqVcru+4:1e3uggaL6yXMMp45VqVcru+

  Score

  10^/10

  darkcometguest16discoveryevasionrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2