Extracted

• • Target

    JaffaCakes118_f187ed4f766f4e8529ded7c305b260e0

  • Size

    282KB

  • MD5

    f187ed4f766f4e8529ded7c305b260e0

  • SHA1

    1e5cf286d066697212b694310a99c9b3d684c904

  • SHA256

    2efda4c48dbd4b50cdef0073ef74efe54faa67e3e091f37c929fd1cba611f0ac

  • SHA512

    7a95ccd4a4617f3081580fcf9db6fa06bb949a12e1178bfe1a16873897df9a5e27c65f0a70623eee85baa0dffec8e6bafe52dd3770a656e448821e2a5d176b91

  • SSDEEP

    6144:Q7DuIRToyeNNkwLq/oCjEqfZgDQJa342ERAiU8AIHHA+:kTo1ZqfjEGZiMRAiU+HA

  Score

  10^/10

  darkcometrsdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2