Extracted

• • Target

    JaffaCakes118_6586843f4309744100692fd240c1d2b0

  • Size

    955KB

  • MD5

    6586843f4309744100692fd240c1d2b0

  • SHA1

    c3555ccd962db33e2a53fc876751f626d69354ef

  • SHA256

    8d8430b1b1c23e76e89492068b2210f5e4ed0b60bf32687e430eec2213cbabc3

  • SHA512

    bbe84d4463086e1c983e9b66af82d25e162d25589e61034ebae4707ade17a43aebe53903b79ea752793da2d7bd91a6805ad23802241ebe645895024d78e3a322

  • SSDEEP

    12288:rphltQDc9izfBurncaXZ0V3lHyUvWNAhrTiBU0dnYrVYm6wAz6DO3K7KDBTlfF1o:kDZ+cPV3ZPEoiBHt0Gm6wAd3KmDtYYM

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2