Extracted

• • Target

    4cf74d9c5858ec807505f275a1c2233c_JaffaCakes118

  • Size

    709KB

  • MD5

    4cf74d9c5858ec807505f275a1c2233c

  • SHA1

    a562d3c4649db10641573fda70151c6e2a07ac24

  • SHA256

    354d9c8829f6cec109e893dc0d508cb89255d50870b51fb7993e89dcd4f7e55f

  • SHA512

    7fde6f1f9f3a571a8b5a08fba3ab363506c696e7ee681dc45de832097fbb2694fdc5a305867c15133d7bfd6f1d6f9c3630bc88a7eeafe66a1708ebba22280cbf

  • SSDEEP

    12288:YMcUk+kRAc24fLzyxJc+N7z6dapztN29j2srAQaKKemQXYkHppp7ET:YXWk524DL07GdGq52MpKIXYkHpp

  Score

  10^/10

  darkcomet0708discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2