Extracted

• • Target

    d1f834a0abe1adad23eb99e9d877e8f6_JaffaCakes118

  • Size

    1.1MB

  • MD5

    d1f834a0abe1adad23eb99e9d877e8f6

  • SHA1

    06047d238c3e5ca4a56a776e03148b4aba5ec842

  • SHA256

    1f665d378d61b7030eca36e761d508c5e98197d54c4b4501ea975a6682b134b2

  • SHA512

    8d2c9ad9ebf47c75d6b72e95875d00428ca5476ec74dbd536a2d67af1b7ac2ec83f60cc08dbe1f8f59d2e6326b26f227c732321e744a9b666ec67fa0640e4ac5

  • SSDEEP

    12288:Na6snd3as6YqYN3/Ry/NdMvQH5M8bKUA0i3PFbxNrOwcxDdArCbnIc4N/HbkGgL/:NviYDCNN5eDdArCjm0P48HZyNwcphW

  Score

  10^/10

  darkcometcrypteddiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2