Extracted

Extracted

• • Target

    JaffaCakes118_23878b9f62f3f0c54e0a34dee7e014d4

  • Size

    458KB

  • MD5

    23878b9f62f3f0c54e0a34dee7e014d4

  • SHA1

    43a09145a8c929a72c15afa9e75be9fcc4a05ee1

  • SHA256

    b9edc4b39442f2db92b562bf3a8a076bb7b4e28d3607d8229fabc6eddd2a1d70

  • SHA512

    2a1f9c38763cda383903a515b3b9264e016869121232458803d598b4286cc3e88c931ecbe36d6620735f65e04da6a71eabe53ccbd349e72f1100cbece43576b8

  • SSDEEP

    12288:NiXRvcd2Oj38yaS0f0gUUYv80V07thY7h:NiXdk8yaSWev8007zY7

  Score

  10^/10

  darkcometnewdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2