Extracted

• • Target

    b8013e0312054d2635ef24902a328285_JaffaCakes118

  • Size

    1.2MB

  • MD5

    b8013e0312054d2635ef24902a328285

  • SHA1

    63f200ccb8f46d74fa6c2f20732a7dff7f1a1e40

  • SHA256

    ab01cbd6f7caf8d17bd7fa7bcc99506be8dd81fcbf4daa81222f44500c963714

  • SHA512

    9dd7dc2504e7ba770576c73a602fe884c417de454ace646b38406db30c5e59fe057117013faf230c257f8eadc03a803889d2c94272f57335d9a20126c57f8ec0

  • SSDEEP

    24576:7xagUxoKN3ZHXcVkVRVPWEMcJgOvTUwwRsbkmif6:2HXXIgJgOQ

  Score

  10^/10

  darkcometwilldefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2