Extracted

• • Target

    JaffaCakes118_f515591832abbf7effede841f62a3c07

  • Size

    757KB

  • MD5

    f515591832abbf7effede841f62a3c07

  • SHA1

    4af08860ad6d67410acdadaad8a41617ffc1fe03

  • SHA256

    730ff1495bab72115609275b399bb180136c14193a03a273a48be7b09b00564e

  • SHA512

    77e513c2b38b6de082f1663007a98c57706f5e391d68af2b91f9b4d7b38b72366b1272449117b6ffad99ec034e39c108f2706bfa812d46eb80b18cb5d73d7990

  • SSDEEP

    12288:pANwRo+mv8QD4+0V16kzmvbrmNtzbMY7+XzYkIDRNE/mqdlHRGyzHnCzN3E0kRtr:pAT8QE+kmXe4iDsOqn8yGURtr

  Score

  10^/10

  darkcometdiscoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2