Extracted

• • Target

    JaffaCakes118_106d0f5d09284db2ba2c4503c6df6543

  • Size

    1.3MB

  • MD5

    106d0f5d09284db2ba2c4503c6df6543

  • SHA1

    43367d64aa3596d4b0b4098e1b20b2f9695650ff

  • SHA256

    b41e92bff60142c0a6f6e7cb139efd03d28ae1c3e4e7030324ce7cfa285826f9

  • SHA512

    b5eba0d82ef1bbe7ef890168a63b831295d57574ae5b488fae0529d1725c081b3d6a2ccb31aeaf9015693518d54e2d8df0c80a15511e82519613fca66956ab79

  • SSDEEP

    24576:RE/WYtHYvXL2q4uruEjBFgtTi1jZ97dkB9YqdKQpQ:hvjtjzI+WT8Q+

  Score

  10^/10

  darkcometvictimdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2