Extracted

• • Target

    3f3b82d1f2a9f9665f91271acf74580b_JaffaCakes118

  • Size

    1.1MB

  • MD5

    3f3b82d1f2a9f9665f91271acf74580b

  • SHA1

    0d111f183b0f944e6ff555de1bb5bc1c251e3343

  • SHA256

    84c93cc7afdd23b0f8db80b4d699a4ad7bf6b17c71c01e84ac027a56a2c365c9

  • SHA512

    1cb5386335892ae7b6c221914133d14ec57fb35db3caaad54b9bd2b406895cbd1825b50932cd11674a51d2624a0741863648b184fc9f16bce90fd30a324f72f5

  • SSDEEP

    12288:mNdxlPwZYg0nUvW9uzPPFhYyzGGzDrslSh/i+nNiiQ4qf9JYV578O922JSkQWImp:mNdx2v1/rsoxO9aXyvT8RYngUDri

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2