Extracted

• • Target

    b5af5285070465af31c6b4dd73bc3493_JaffaCakes118

  • Size

    914KB

  • MD5

    b5af5285070465af31c6b4dd73bc3493

  • SHA1

    058681ca8684f531b39c526542b1bba0800ec4f2

  • SHA256

    d30de0a40f5a5851379af03e76911fd7c022f7aa9018c179961aa7a0f48a73ad

  • SHA512

    45f98af19bcebbcd56acc7d9800a618ffe1d2b1bf9cf34d8952be3630ec8d33d71bacaab6ebd432169c190673ba3c9e15694aca815004a0b9dfe2033fab2400b

  • SSDEEP

    12288:92EhMcKt6KyueLBwArmUXH/D1Bpxp5Oo3vU0JcCQ9xixX83hCYXepMC:UCMNwKybL1rmUXr1Bpxp5Oo5bmUMCYi

  Score

  10^/10

  darkcomettroojandiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2