Extracted

Extracted

• • Target

    JaffaCakes118_21869a2e70e6e250f167a1432f4c7f85

  • Size

    950KB

  • MD5

    21869a2e70e6e250f167a1432f4c7f85

  • SHA1

    37cb7c9616c530361adfe3e3f37f58653e29d1cb

  • SHA256

    af3abbae00423af0d7ea417c0a488c66744e7dcf09f00b34967c620809622a20

  • SHA512

    48444832ce4f6e0c1d1ac517407800d060f19baca79aa5a25c62dffb906a6ea1f0fb4f146e6301a5f9effc0575fcb1b7a6a7102f5b09c3d27611ba2daa2be44f

  • SSDEEP

    24576:Rayr5Ms1sZAnfOUibyKbCaUvaTRb+zQy7A:51sOxRk+RA

  Score

  10^/10

  darkcometjonasdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2