Extracted

Extracted

• • Target

    JaffaCakes118_ebe72956620e7e9a08f1d188ec1177bd

  • Size

    782KB

  • MD5

    ebe72956620e7e9a08f1d188ec1177bd

  • SHA1

    0640d80beb87b38fb9e08bcb6f8491bac20c716a

  • SHA256

    c2b0a78070678303e8e7c706d0f0d30846d92ec784de1c74c01802860cfae7af

  • SHA512

    6942ce2bdd7bb1bdfbe0e894f3763dcfd3ea8cbdf7cebe358e6d4abae2361d2aa24e3e1fa00953e0e40aa86e4fdb9afc797e45313878e0e9df4635eb6bec665a

  • SSDEEP

    24576:GaQkTf4PTEe06fikyI/mYVKahmf2SlCuFfy6CMuh8:qkTgrX02ikyIuQhaXaTMuh8

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Downloads MZ/PE file

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2