Extracted

• • Target

    JaffaCakes118_7a803f896396793f1c310e37ccd75830

  • Size

    729KB

  • MD5

    7a803f896396793f1c310e37ccd75830

  • SHA1

    eff35c28bb048731602355687d71b8b09ca9fa11

  • SHA256

    80e3e57fb6aada9da17a4474b3a871e61ceb24053ce295405912498af6cf75f4

  • SHA512

    e94700e5635248cad7a79b9a8032b68df1b0d60e970fd8b901f2be0616777a66d41e6d81d65405e8d5d823a8dd1155bfc9bb8224bfc0539b9bcc54d1a2e2c83d

  • SSDEEP

    12288:D2vRcIdCtImmDcwvxPnHnuKMM1SSqkV+MrEljp1KAGJpx:iZZCIDvxPHnvX1A/M4Zp1Gj

  Score

  10^/10

  darkcometab rio intdiscoveryevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2