Extracted

• • Target

    JaffaCakes118_b33556f7f35cd30ebd0a23369d018ff6

  • Size

    1.3MB

  • MD5

    b33556f7f35cd30ebd0a23369d018ff6

  • SHA1

    c7d364a84391cfad195335174776afa5dae38a6b

  • SHA256

    38f715e43b2775461d7479b02648ee367580b8ab9580e7ab3d28072eff2cb869

  • SHA512

    0305f82cec959f4c7a03c9196f8c02cbe4064f648510cae60bae3696d771187f7527335451cb5bceaaf83e5df5d5afe2cdb6d48bb9c32579446a446bdbf51566

  • SSDEEP

    24576:RljkBtiMHWO2kEKWdlFaSj6BQIu+tAqvhHkqSnTKs4iYtA9QoR:RdkBtiMHWv3dfuOIRtAghHkqSThPYtat

  Score

  10^/10

  darkcometslavediscoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2