Extracted

• • Target

    46a164b4d55bc0ce86a0eb8d1f0bf0ab_JaffaCakes118

  • Size

    1.5MB

  • MD5

    46a164b4d55bc0ce86a0eb8d1f0bf0ab

  • SHA1

    ec07a7fb5cb84172a23df4dbc1859e986731c2ca

  • SHA256

    ef620704c613700230068fdebce73e5c02bf55eab3c769f254dae8e836bb2e81

  • SHA512

    166ccc1541e263803ed1d44fbdb839bdff4d2d590e1ece918c7d1ee53e234ff01e71ffdc7253535f63751de933c74034e79dce5a893c0ef2a172fd8d63cf9cef

  • SSDEEP

    12288:4ejq8CtSp/MqZRWxriTLOucGXyjmrDNZnwAvYmSev2dJryCTW8H/uufTJC16BcjJ:ZRWdHmRIluk5lqqvx8zbqGEac1Ty

  Score

  10^/10

  darkcomet10101010101010discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1