Extracted

• • Target

    e4d8070ed83cb69d589510508b679808_JaffaCakes118

  • Size

    958KB

  • MD5

    e4d8070ed83cb69d589510508b679808

  • SHA1

    32d001ffb32703729ac94389ab945a7ba78cd76e

  • SHA256

    73a7ae02015a58839a5ac701a2728e171ebf0c97d4ff02ae981069477acc4db8

  • SHA512

    01c8e034f6b3620143dd42c4969feeafca79a0817b4db90698726f0e1d9cec70f32a8ae6a394184942982d05a008d7a64594d619ade22a19c102e807632ba3b7

  • SSDEEP

    12288:coWRXLoAB7iJUTobcwdJim50xewrFiZ5nZY:0EANiJOPOmAwy5ny

  Score

  10^/10

  darkcometacessodiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2