Extracted

• • Target

    aea6da14381b2b35443ede64825c992c_JaffaCakes118

  • Size

    716KB

  • MD5

    aea6da14381b2b35443ede64825c992c

  • SHA1

    3c13c5b0553041bfae7d8c2c790ec63d79cca0e1

  • SHA256

    f0f5e34f413e2e22777ad229f003759e0e56b4a038974b85e930611067cb84e7

  • SHA512

    86557e50b51d4058b3e3a50af6f429ed0520042b0af606739b82aa322e7e7d9c7d80f81c558969f5e12287b08bdd5e06818145c813b6b80a2c8f2c79011b3398

  • SSDEEP

    12288:7VLJOQr8WcV3wOhm4MbM2ev/B2f4f1nON+1Gs9ijVb6ep254:7VLJOPWcV3rhYincaGs9ij4e24

  Score

  10^/10

  darkcometguest17discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2