Extracted

• • Target

    efe27fd5739f37d46e1f9fc7c3ccad58_JaffaCakes118

  • Size

    533KB

  • MD5

    efe27fd5739f37d46e1f9fc7c3ccad58

  • SHA1

    7ab9cc88e288e58a29b253058f13ffd85d844f1e

  • SHA256

    735a0da4d37b839e6385f08203527f0a21b8a5b0e024722fc4bcf63872e72064

  • SHA512

    90db33784954e776f65e51f721641c47372ac8e7481e3f0ebaa6c6611d54ded34fa2414347b3b21c9f75236a2077f7ab6397fb518740dfee2e69151df12b63d5

  • SSDEEP

    12288:PoOgS41Ye4ypiMXsIhvhWieV6C3B3oeyhRJPFRzRUjQKXNKzSoh:PoOgH1HxJHhpWD8GBYXvqtkzSS

  Score

  10^/10

  darkcometguest16discoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2