Extracted

• • Target

    ffaeeee9071cef34ec7e83431860733e_JaffaCakes118

  • Size

    401KB

  • MD5

    ffaeeee9071cef34ec7e83431860733e

  • SHA1

    d053f64e9d0630adcb9a9df1c4de3c3da2ffcfe3

  • SHA256

    0b366adfcdfb5f69dce19a4083115cfd946dd951ee3ca0c9ca04d6a5d3d78b64

  • SHA512

    891d4d3212500453e4c42098debe5e5bfe019924b93c45801661dce933fd749b8e77c02c67c5d998f279bf30cc84267b927a321a4bca7268d246f274ea506e12

  • SSDEEP

    6144:NOavyIMd/QD4yK8WL3jhmsHzaMX7LtpXyAkfzAjI9ESYqIdXY8xE6zNTVWGR3m2h:4avNK8WL3j3OA7LTClLAjzqtnGP

  Score

  10^/10

  darkcometappiipersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2