Extracted

• • Target

    8e3e5a4b416091a72b3a861c5393fec3_JaffaCakes118

  • Size

    425KB

  • MD5

    8e3e5a4b416091a72b3a861c5393fec3

  • SHA1

    be2f0df81ef450287f56b1a40445dc8f1fbcdef3

  • SHA256

    1485b843e94e04eab3bbb59e6131f53bb9b10b260fc87591621dbc1996ea7647

  • SHA512

    0b58aaebd261b71b7b7ae22f06633fefc8fda6f0844150d06c35402e22c6464605a8644881956fc81225a21c47ad78fd855e1aab177d15302d822602ce7a08d3

  • SSDEEP

    12288:15SJzw+aV+6d+TE+5G+IW+h/+7/fPHKXqn1bjNS/t+R6pikSvCZRLJF:v1BVJcQk/Iq5MYAp5JLX

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2