Extracted

• • Target

    512e15f39afaf4bd204454deb4f2bea0_JaffaCakes118

  • Size

    1.3MB

  • MD5

    512e15f39afaf4bd204454deb4f2bea0

  • SHA1

    861246e9af0ecdc148ee87f1103d6ebdef5ce991

  • SHA256

    ce0a51650f34b2fe144bb4e75e3c02ce17620747286261cfc63d203afda26d21

  • SHA512

    75a09c73f4531ec80fb51b24e0592d231f52257a25f1e243403cebf1ca0e01af38e4545e8f4b9612c5fce0e82045d85380360e3ed4f25693165a9cfdc8d63e39

  • SSDEEP

    12288:2MeRfvBd3gpuNWd0nGTpcTJAmfCppjLTQ14CtYMyhEeWcb2/iM5xZGQ8WwYSYryJ:2hpCzNkeEpFwLzISPTr+p9D0QZh9u

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2