Extracted

• • Target

    e5379715dd0f4de193007edcd19852dd_JaffaCakes118

  • Size

    808KB

  • MD5

    e5379715dd0f4de193007edcd19852dd

  • SHA1

    489920ca30cc192d100f7c0fe96933ff0760ba11

  • SHA256

    c37f15a3cfe8fd09c43d542117b650d202a86cd95b0dec645c943f8a8ed5208e

  • SHA512

    16f952c5ada2f2c2085b5e89bd61b95b9258f4b503618c37d1f91724a4d6bfddfc468fa3b58a987b28bd19218b2747a0bdb5d06a16c2c1a78dca74b21a4dea9b

  • SSDEEP

    24576:VQ2JWUJsF1zwstoajoZ3pbst90tmTnF9Tx:ruFSsHjk5bK7XTx

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2