Extracted

• • Target

    fc4a04c594d1edfd93f9e8730080f4e4_JaffaCakes118

  • Size

    1.4MB

  • MD5

    fc4a04c594d1edfd93f9e8730080f4e4

  • SHA1

    4e66674709ebcb06ce110c4189e653f8a092e2e1

  • SHA256

    90258ba478bc7d9e0ac1150bc3c28cf221644938ae1ef57e97e8b9c0a74947ee

  • SHA512

    817d16bcf927d08e31daf649ab9ac70351b647474da02aa850ff20302a92aa27bdf2faf067eb93a54076d4de381f58772d26234b37a8ad1e4c62d557fc182c2f

  • SSDEEP

    24576:0F8qFlZv4fHF5baAPpA+n4oSiBBD8Atq2T7sPyPGNv/HsAqp:0uNhBB8iP+0

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2