Extracted

• • Target

    JaffaCakes118_eb3ed8ce02dd129b9ea0e9aa85cb02db

  • Size

    1.2MB

  • MD5

    eb3ed8ce02dd129b9ea0e9aa85cb02db

  • SHA1

    8633cda2940944c6073de1d75ecab528bb8e5bcb

  • SHA256

    96490026c9ac2643164c9ebd47941c560ecf92f513d113a4f15978d9384efd86

  • SHA512

    c2c8c3c09e542ed479b5bbfab35522b2a2307c3a87609968ad0fb0f67230d53559b6a63bdff8c4a42976d91d3442a25930ef4a5df6124b224e6862aa49f908c1

  • SSDEEP

    12288:EAXi8O4mAL/cKaUNGCYrWkW+2npQ3g5KhUy4GW3BLdIBPl76Dx4ASNLAwE0iM7SL:E8IWb2NWxpjRQj6DFfsZbVQpEvw

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2