Extracted

• • Target

    JaffaCakes118_65d0e2f6e383e4707c0a1fff936cff20

  • Size

    752KB

  • MD5

    65d0e2f6e383e4707c0a1fff936cff20

  • SHA1

    b7b626d4cf6019affe1bdc2a0a34bb36db501a09

  • SHA256

    5d271089ff6c13203578bfadb766ab8e5fdba62286b0b5e2e49c8afec3a0a57b

  • SHA512

    44786b30bb295b05ffb9faaa30672e3f0c8bd79b63c41c12129e39ce1018c34ac1e270c6f3a11196bc485a3283d8efbb7442ea1bcd55f2855931135c2e8c1978

  • SSDEEP

    12288:XJKzhtpGxWkF1czht1G0WBLw3KLNzZBJQoZqdugoQzkxE9c3j9HHxp1+:XJKzMZuzht1G0WxVthZMlorEa3j9n

  Score

  10^/10

  darkcometbt realdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2