Extracted

Extracted

• • Target

    JaffaCakes118_ebc25bfe3cc774a055545de8164d0664

  • Size

    928KB

  • MD5

    ebc25bfe3cc774a055545de8164d0664

  • SHA1

    89bf031051ab855a4cc8242834aa90fd8f4976ba

  • SHA256

    ad63affc9fec552718ffcbe455a28da2b624cc47ce77e5a080d06d0530da9979

  • SHA512

    0e2ec5849f17afea0bd774f43351c647ce4b0f4d56e064e3b0d47c950a57cf34217c33bef8057ca5c6ee16b38c6f4ab1816f03fdbee2188f6cb95ece03ee0f86

  • SSDEEP

    24576:jNRPe6QDl+boqI3KB8r/5ou8I46cnuNy0T76WCh/Gzv5HgfYr3B5:JRPe6Qx++3q8rIxn/08/1C3

  Score

  10^/10

  darkcomettommyhfdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2