Extracted

• • Target

    JaffaCakes118_09e6721400a9d479f103d682e0e9d4d1

  • Size

    887KB

  • MD5

    09e6721400a9d479f103d682e0e9d4d1

  • SHA1

    14045b8a3635dc696704ccf0e9e6114ac811605a

  • SHA256

    0c3f46ae3fc505174a3b46dc142282a83d1d1f7c101dd325562bd52786385ce5

  • SHA512

    2ec055eb9eed61a27b0d65d4b737ad261fbcd6c49baea300f23e93735d54c647ddb05d188694761c127c745518f4f2210ebe4441b5bbe84d12ecdbf28c33278f

  • SSDEEP

    24576:D35J2CjGhO9uxFXP5E8DAzWAvGI+Zunfign:9YuJIAjgunf

  Score

  10^/10

  darkcometslavediscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2