Extracted

Extracted

• • Target

    JaffaCakes118_01ba85baaa114b38b6cbe0edb5b96df2

  • Size

    1.4MB

  • MD5

    01ba85baaa114b38b6cbe0edb5b96df2

  • SHA1

    ea197b23726e4efc7644f483194c2f44d7064964

  • SHA256

    02eaf0415ead45dcf30f2d9a69f31dc2f26d07dd75ec6ebe3416e21da53ca147

  • SHA512

    7c0a1b2d2114d986517a29ab9447892f39069d304888e19623b06d921d9d71278661097c0db7e85e4d3550639b431919d70bb7360d55cf6398de43f362895630

  • SSDEEP

    24576:BYUET2FXdDBYKYjiCcFFf/Ygp8yFKKiKORnh:qNT27eKgevf/CRh

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2