Extracted

Extracted

• • Target

    JaffaCakes118_80b57fded2545f6117d2bb61c4f1abc3

  • Size

    774KB

  • MD5

    80b57fded2545f6117d2bb61c4f1abc3

  • SHA1

    0759097ed2ffdf783d6d62aecdee4cac62a917c3

  • SHA256

    29e7af74c058023ada93e20484abf4c4e56e9d97d2b95bd61d6afcd9bfa042e0

  • SHA512

    de9f1ab6ffd7c9c3def72e6f512387b2132a6e36c69f5b5d3fada6af21c74a373fbc8639c140f23a4e8b43c67efe0f06100bb84e231c7556af8f86956eff2590

  • SSDEEP

    12288:nLneYlTwlTdwjfzDROheKRPtbQtzSSG/5NhFrJQMaL2Evn0vCNC1X4hWHw9v:nLF2mBOhe+CC51JQfvn0lREgw

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2