Extracted

• • Target

    JaffaCakes118_77ba73d7bbbc090b89b365f19af18ed0

  • Size

    1.3MB

  • MD5

    77ba73d7bbbc090b89b365f19af18ed0

  • SHA1

    f2db1fca55180abacfc259d5db6b4f1a60704930

  • SHA256

    6919e931d6176933332f7e31603a6b15f54b25330bf58b777e2aeab835e5f0fa

  • SHA512

    6d25a98019f7048d1de00d5dd44736158a95a76617324f96b63336b3297dfa34585556cef0ee138b58d9ddc0d205faa92ed2bd5e2ea708ca28888170b20a687c

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaUOuGkZJrT53PJgGZFGgAocQiecZ:mJZoQrbTFZY1iatuJZ9T5fJVZFGVQiXZ

  Score

  10^/10

  darkcometguest16discoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2