Extracted

• • Target

    a6c276ecdf80e884ddf1ea1ee8e47333_JaffaCakes118

  • Size

    1.7MB

  • MD5

    a6c276ecdf80e884ddf1ea1ee8e47333

  • SHA1

    175f19227e7e4713f2aca3e921a870ba9b104e37

  • SHA256

    5b05f39849ba86edcaf780e7eb3721fd40dc54fe8591208784860f31bf9eadbf

  • SHA512

    f627a1fd89f29cd16c4e207678995b059ebb4f844f782b2022314db321de2bad1f29ceda017c44d8ea460824f739b26c1d0d248a1c06d8948853968299098294

  • SSDEEP

    49152:xNp9txvr44OO/dHuky5mCpp5rHN3No9N4tKm+fjmMofknWbRvFGB:7zt5U4Iky5mCL5rVMN4UmAjmxfknB

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2