Extracted

• • Target

    JaffaCakes118_303751bcf4517eeddf5920ff491d5cbd

  • Size

    655KB

  • MD5

    303751bcf4517eeddf5920ff491d5cbd

  • SHA1

    0d2e3554918907d6f90a722a6579e047e29545c4

  • SHA256

    79d109267b68ce87a577d79fc23b4c0a9491915ff2d1fd11dc270d608f679653

  • SHA512

    6ff1124acd386214249beab58142841fc405a6f64121f7e40938655af6563ba934cfc8da76bee2c94f47d87f77ff074566232e859a82570721eff115d239c3f8

  • SSDEEP

    12288:jpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIkn/r:lwAcu99lPzvxP+Bsz2XjWTRMQckkIknD

  Score

  10^/10

  darkcometguest16discoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2