Extracted

• • Target

    7c656d957be3c16e1d2efa142bf4afd0_JaffaCakes118

  • Size

    967KB

  • MD5

    7c656d957be3c16e1d2efa142bf4afd0

  • SHA1

    8ae1c8140c889284a84a09ea5eb3767efffe4de1

  • SHA256

    e221d9fd274c6167d3bad5e0f79f7508d585fbb7cd7207aa5e0da04454807f18

  • SHA512

    a49e865884647f59c65b628ec8541ef5f7f8fabab5a0e20145528fed9fda5d1befcb3c959278a56309634138f24fd263ff995ee8e2ce0224e509ae54d5a39447

  • SSDEEP

    24576:k5Mw8EuSaJZMTemyrgVz1bxmwmvg/J7vFPN8:7BEaEirgVzHB+GV

  Score

  10^/10

  darkcometslaves2discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2