Extracted

• • Target

    f37d8671581ece41d0a14f8ff5b670ab_JaffaCakes118

  • Size

    732KB

  • MD5

    f37d8671581ece41d0a14f8ff5b670ab

  • SHA1

    8cfb4a0a8f32fcf5f549a8c8c171e4434082aa81

  • SHA256

    d5ad3121adfce989a111f0fa0c5b2061665f1ac6a8aaa262a8686a678ab1aa14

  • SHA512

    052dc76618911f3d4184d2fbac79f8959f4b57d6ecd36f1e07824695b53feffcc292fa3f4f937d1bd6f7afd5de7263021cf68c1f10d836276d646d45bef363b3

  • SSDEEP

    12288:66SB0hewsAXAqck0X1yv0I5Z0LaTAeLfofyQa4m3PZp2pxE0d:6nKhewNAzkS1yMAlA6ump2pj

  Score

  10^/10

  darkcometserverdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2