Extracted

Extracted

• • Target

    JaffaCakes118_c24b23d3c854fceb5e4af9d151ffe7fc

  • Size

    7.3MB

  • MD5

    c24b23d3c854fceb5e4af9d151ffe7fc

  • SHA1

    90419748e89d38f964db9e8eac4ca62b6a355460

  • SHA256

    8ed58fccd0234e53dd1b82468875c8e34e02c4b6d51c93041077bc412fb482bf

  • SHA512

    fe9b05ef5bb9551f7d6f8d72afad2e6e40a646e8c897213c0aaed84f7b3960c8ea45c2f3a48a35a0f3140cd97e79f9b5c8d376ff140b270b3fffce87504c78b8

  • SSDEEP

    98304:3Xo61VhZXRqa3KNLY1zNwrTPzQAqZto4OP2+95Zohk95TadWSMBoAI5Ku77v:no61LtRnaNM1zBOPjdohk9Ra0Ss9

  Score

  10^/10

  darkcomethackingdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2