Extracted

• • Target

    96e9564254f0acc6aa656cb56ab0e94d_JaffaCakes118

  • Size

    11.1MB

  • MD5

    96e9564254f0acc6aa656cb56ab0e94d

  • SHA1

    b0d63f3ce6bb82c649cbc7a17df774acbf23477d

  • SHA256

    1a722652518e589be34613b12d419efee2235ff0b0a37556fbb9cda5eb27b1d2

  • SHA512

    69d05b841c558dfe8f8ad8527e8f9450e68becf50bd0d89e372d8cc8b61770bad6d3a94b22ca858829a613d8c563519d0cc92d13f918274ecacb46799e1103d8

  • SSDEEP

    24576:4RmJkcoQricOIQxiZY1iaZzCvJtvGCeEy0KHB7pKiJdZPgiIOkuqWrZRex2BSo+8:9JZoQrbTFZY1iaZzCvJtvRG

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2