Extracted

• • Target

    JaffaCakes118_f89be3019aa47cf5926062d8fa4227fb

  • Size

    1.1MB

  • MD5

    f89be3019aa47cf5926062d8fa4227fb

  • SHA1

    1db9004df6556dff405aabed9365bbbe5f052dcc

  • SHA256

    12682e378ed4d01eb7abb0b0f0e38432e5884cb56b8bbd155847a0fd37905ff8

  • SHA512

    5b4fc70e8fe21db5eb5b8a2585bde02e3683b89e4c5f4e482f970ca6c5f2f48865787d47eaa411713923ee32105d4d8851af9e01e37b5d5405e5ce8b8dd4e2f8

  • SSDEEP

    24576:4fHK4ne0H220E81P/RQmKEhQSt+TrLQse4xoQQZnt1:GXl3eb1g1CQQ

  Score

  10^/10

  darkcometdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2