Extracted

Extracted

• • Target

    JaffaCakes118_0c44d4aeaa53617104aba0d574b4d95e

  • Size

    5.0MB

  • MD5

    0c44d4aeaa53617104aba0d574b4d95e

  • SHA1

    887183f1481c47125a9e3dea58e87ac593162c77

  • SHA256

    04b0cfb328ca45db1ef9f29cc854c48c569b9891b195a10d33a4eefda185f789

  • SHA512

    39e060a906f726763b51ae875de3133fd31e7570651267ee318915876c4ea1c03556a943fdd32d0c751286994c7f7155d67d5fe5fd11f54a34e86e2cf3c02ca6

  • SSDEEP

    24576:1////qja+7IP1JgNt6udKan/B7J/Vvih9zJZaraB:Wlke+8K67JFQ

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2