Extracted

Extracted

• • Target

    JaffaCakes118_396698daa84449bbf7cf77515a9873f0

  • Size

    513KB

  • MD5

    396698daa84449bbf7cf77515a9873f0

  • SHA1

    98ef481cad067560a6719b3dab9833534e56902c

  • SHA256

    13189cbd25fa0734030af69d72f0d13552b4d491d2ce7a837da3a16c5ed1ef50

  • SHA512

    3c864ebb260a47d012ce355a880f02decd402fe21f6c6ea633805133ee4317ad3e321f5a96bba30a14ed4ed266dbd5520f75958e4b03ba8b24d396090bd23042

  • SSDEEP

    12288:UL8z6x5Pfz0GNTK7KgdEy1/kgfLeTHeVZmf:io6xVDNuugdB/2LeVEf

  Score

  10^/10

  darkcomet0603discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2