Extracted

• • Target

    JaffaCakes118_b02a280100658dac180fb724e5795d63

  • Size

    887KB

  • MD5

    b02a280100658dac180fb724e5795d63

  • SHA1

    463c0bfb9bf373fde8cab6c1569bfc935e29217b

  • SHA256

    c496be4729da4a43a85535f703376300daf37aa4b4afdc152e458a2d19252635

  • SHA512

    6ea78c90c90ebd7bb45fbd784e666a3a1efbcc9bea6d7c23c90528c742dc8b2546d8efe1dd9894d1ed5fe4b830c3d112f2079e4d2f2856d3dc0bbf051789083d

  • SSDEEP

    24576:nrmYMFbtiJ2j+ozNoVv4HRZs4zzE22OGPK0zm8o:EFAMGzz

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1