Extracted

• • Target

    188a433ec37744980bd5447675e6f4c1_JaffaCakes118

  • Size

    405KB

  • MD5

    188a433ec37744980bd5447675e6f4c1

  • SHA1

    928d2aa5cf082f5c21866df3c3cbe345dbabf357

  • SHA256

    b759beb7f21fc18836d930d48286e98e5dccf449d8ea851a5b936e0557147dae

  • SHA512

    1ff298367d1db404bb621704b8ff5c58699c7a2e10f23b242e5a86e83a1ebd05209d6a93f81b8b59987f8c506d9f1a6bef58103e9a294c2c1891aeb0f5aab0a6

  • SSDEEP

    6144:RewhNckA6ec4X0dC3ThO/W8ig3ADIE1JZ5d7rVZF2q8/E4e9jQjSKtKiuzNVCu2F:Rn5A6edEdMO/7iutC12b/E4oKsiupu

  Score

  10^/10

  darkcometdezemberdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2