Extracted

• • Target

    JaffaCakes118_e964044329ee1fe2f6eb63527bdd22a9

  • Size

    4.0MB

  • MD5

    e964044329ee1fe2f6eb63527bdd22a9

  • SHA1

    d5c19ce79cf88e6d1ca554b4bdb0529596b8acf0

  • SHA256

    371e8def882efd31f44e386edb0ae75fa58eb750029097919c4bc1264331adee

  • SHA512

    2d742aa3bce3750579725ae3ec43cbc9a095173b2b305d849775f048469781b5de8adfe02bcec127b2229f820142159f49cc0ce3ca55a83940b3b9645b88b053

  • SSDEEP

    12288:VAKJJcpI4EQgvJmMk3qL75ORfUjzxQqm0BdPaPE4c3y6W+et3cOQSUrKyCtibAJ:BJZ4c5kgORfUF1dPa8RhW+AMabyVAJ

  Score

  10^/10

  darkcometguest16discoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2