Extracted

• • Target

    16e55ff4bcfa09e92f6f5eb907935e35_JaffaCakes118

  • Size

    1.0MB

  • MD5

    16e55ff4bcfa09e92f6f5eb907935e35

  • SHA1

    0e1d213c1cd2c2e9c56ed67a5bab9a0a4df2b371

  • SHA256

    838eb8a75fb50b9591f7be47a2f0ad3f89aac80bf91604cd96fb0fa3a558a098

  • SHA512

    43e304e3b75d1e7185211b6b1c94b8b310275b74fb504a382382c83e282e7f7db31479a27c6aa47553c39a8ba08e29e4df9aa45bf1fce9296d1fba5da52c27ae

  • SSDEEP

    24576:xEGaHuTpegXTAScsuz3WMdcDLV7r/v59:iiTk0cDMR7rv5

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2