Extracted

• • Target

    JaffaCakes118_69cc617fef29c0a1e882cc41bb193548

  • Size

    1.1MB

  • MD5

    69cc617fef29c0a1e882cc41bb193548

  • SHA1

    9c33a92364491d9604a66362c7ae20299b3a7cdf

  • SHA256

    18fe2153f5dc3550d3e8e4d6196cc2379df48b40b0573b2e8361a0163c736005

  • SHA512

    18885e876690c1e61eef968ddbb954e6d597f70d11caad7f7dea268212d9f0ec30b192559e13989525977e63112634a361a71b9504524c835049ecce07ee4c42

  • SSDEEP

    12288:kpU9b5pYXaiD893Y3GliEB+VF1R89Q9Xxr/v/tF0ZS/iGDnl724MIc5JOa0EFmDj:N9b43C3laV1n7qeryMsRVWQf7QTr

  Score

  10^/10

  darkcometcyberdiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2