Extracted

• • Target

    5799c36ef14b2d929c07091d02035afa_JaffaCakes118

  • Size

    1.3MB

  • MD5

    5799c36ef14b2d929c07091d02035afa

  • SHA1

    067d24dc4551b16018eb331ed7c9825f7d53baf5

  • SHA256

    e1263cb3be07c995a401f0330cf9ed5c1ac312399a250a8415dd64ad465ddac0

  • SHA512

    5571a35c68936ced6d38162184fc2c36bc91671ddaf43cb6cb17c1176cb214cc9aaa671097b326d99112d13025ee486d6c3e978b5dfaba08480b10118b658937

  • SSDEEP

    24576:qg4LWJQyPxbhsJg4LWJQyPxbhsNZ1xuVVjfFoynPaVBUR8f+kN10EB4:qg4LWJQihsJg4LWJQihsXQDgok30J

  Score

  10^/10

  darkcometvittoomdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2