Extracted

• • Target

    6d7fa944e9a17f0ae00c821c5c8c1541_JaffaCakes118

  • Size

    1.1MB

  • MD5

    6d7fa944e9a17f0ae00c821c5c8c1541

  • SHA1

    274f3b46c568650a558b97cc33fd675fb9ff24c2

  • SHA256

    c8beb8bb5806e0f3cc73560b3e8c1af753991b17b52c8e8a5ed0eb1ef9ea7ebb

  • SHA512

    3ede0205a4b671c5d767d51bc5c990560ff2656c3dc0b631184be8d65f10d0cf19331c7300eb459124be589462dda9d4fb6399e7726af599a46f24afe26f448b

  • SSDEEP

    12288:ZNdxlPT6ZYgGDHOlh8YbHlmZoQK342qY0+7O9g4pzRAT6jL1wCGCO2VdsLJZcuGK:ZNdxkSAE57O2VPun3NRYngUFO/

  Score

  10^/10

  darkcometdarkratdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2