Extracted

• • Target

    a4775f01c2ac1787f0af8da77a573f34_JaffaCakes118

  • Size

    520KB

  • MD5

    a4775f01c2ac1787f0af8da77a573f34

  • SHA1

    f69764279fc5a9ca61d7103366b965984473b0c8

  • SHA256

    afb6214ad1bd97c9c1beecc69d5d2fc767249c4bff4af435ca51fc3aa9b21d02

  • SHA512

    4d78915798e1ec01b43869f0bd29b85405e821824e71206130a6266e24bd3fd43a9f6672569b758cb23b9fa756bf44fc0ec1d2c69a287a01e94cfda1e87e9c11

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbb:f9fC3hh29Ya77A90aFtDfT5IMbb

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2