Extracted

Extracted

• • Target

    JaffaCakes118_08509d5612f088c46f1d859cb965c7df

  • Size

    731KB

  • MD5

    08509d5612f088c46f1d859cb965c7df

  • SHA1

    d3c0849e58909685e377fb52a5b4e3fcf15f0c00

  • SHA256

    91dc2eb012af0b120110734c63171424e2ded01c5ed48e887631f9cad92cc5e8

  • SHA512

    b89b6e1c75e3e140311d7e58d265e93dedf8ca414822dab4c4eb7282c8b08b507e0cc0b2db767b566b0ef9e5e9809722e43cd0dd9c72ecfc98d5b98acb3233c3

  • SSDEEP

    12288:jaUWjsRbTquJjwdjk4hSODKvN4VObb/ic7cmPA/QCa+Bz+Y8ZeHzbrJfIj3:jaUkCKuJUFk4MOSoO3/r4EA/QCa2+Ncw

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2