Extracted

• • Target

    4dbbec1d181f1e8a146fc15a2de845c0_JaffaCakes118

  • Size

    808KB

  • MD5

    4dbbec1d181f1e8a146fc15a2de845c0

  • SHA1

    1e45513f89802d5fd9d017e01642c8d742f5cb90

  • SHA256

    4154bf6a7d5e70d9aa7a02bef28bee9210d3e471eedbb08de8483c6874e2730b

  • SHA512

    e5c9a066626a8f7927a6328fb63ca64cafed8bb4b4548f171ef98445f4f51b9953978d4506e4ca45a4e5dc49cf84379f098c7f334a9c1fbf429d20b4b7830e88

  • SSDEEP

    12288:xLRX082vL7tZiF2Mq6CoRKTpi00Mued45cChs/8W5livkT2y95o0MsE:xLu82vL7mDGTpih6xChsHl5DH+

  Score

  10^/10

  darkcometvictimediscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2