Extracted

• • Target

    9e8ddf0ec3b3979e9649a9e7cd1f689b_JaffaCakes118

  • Size

    761KB

  • MD5

    9e8ddf0ec3b3979e9649a9e7cd1f689b

  • SHA1

    1939ce2001c6144a63a925c1b2c680bc402485a7

  • SHA256

    239f7cb413edc0a3b6021b8d11bb8582693305b36c5863af5be6a686c6eaef02

  • SHA512

    19d8272616adbeabdb22994f8d207a91e260638a9b9ad7602ca0aa5e1104dbb0b3f8ff6a766465f8650bdcd366bf593adba430d556deae039f6264f8a7e5f71b

  • SSDEEP

    12288:L3ybhhs91RfbNdX7yHSDESfGOKK3jT19qpjGd5/ozBV8HeDma/CsAYMh3/hBXw:LybL811NdXmHS42GYT1ojo80Wma/TeZm

  Score

  10^/10

  darkcomet1110discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2