Extracted

• • Target

    JaffaCakes118_02e2120ae73f45f30fe140d7b6e90d98

  • Size

    760KB

  • MD5

    02e2120ae73f45f30fe140d7b6e90d98

  • SHA1

    3220919465989236c7a886e4816236c738b3abc5

  • SHA256

    034dd5f6be4f9da37e326472542f527b921443939b1b41b2f4ac1371f475c26a

  • SHA512

    9e6bf2c2c4ccd8d7edc5b4ccda5fe461306a1826be379c2e8845b6b95ab5770ff0488559dbcda54e1ffdb4039104b58a2eef42b10e73eebb8b874ea94844e21e

  • SSDEEP

    12288:KEBZ4Qy6YX5PgkSndWqbG4gbuoBFfBgmlS8J8jYtzkxaplmdRl2Rrk:By3X54knqhILXfCmlSuqYtzk0ela

  Score

  10^/10

  darkcomethq-botdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2