Extracted

• • Target

    e635cf1f967e29ea6078f4a5491b4b89_JaffaCakes118

  • Size

    1.3MB

  • MD5

    e635cf1f967e29ea6078f4a5491b4b89

  • SHA1

    6faf30de2b4b1e198650bfa9aa054ceece5e8a2a

  • SHA256

    a56e1e7aad8332d9e8a2b349548599ff11b6c27e576a627b2ec9d822964970a0

  • SHA512

    9e8e26a437355e1fdf2ec0f621bd32b10cccf74886ab5631396bf668ffdcabf2635b81e23c930f26b55be988a84af73cf79801eed362fb4244f72bcf4b39ec3e

  • SSDEEP

    24576:XarjK0uR6rw4Sp/rhEBjhOJcc5eJ0dpnMiQi6U6lCT4dvzR:XRmB4pnBHOO4dbR

  Score

  10^/10

  darkcometbcdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2