Extracted

Extracted

• • Target

    JaffaCakes118_23d32d31de62b9b83320fb0a3f6df6b6

  • Size

    1.6MB

  • MD5

    23d32d31de62b9b83320fb0a3f6df6b6

  • SHA1

    f590b0d018d80bf75212f2c816876d9cc22c9445

  • SHA256

    0664a9ba60ad6c321e661734db809b2260a306def2b53eba9c6f0b178fdbd110

  • SHA512

    ee9a93e909638c3e02d2f9d400962e0c5908242faf8fb66977847f959e3064b60a6a1202918f704fb16248ec6cc1db738b73ca9ad3aeab49f41b872346aec512

  • SSDEEP

    24576:c7I1CObop4dRTa5hqY+pTdFinK64NAqGteyj:cc1zo/5hqYz4NAqGteE

  Score

  10^/10

  darkcometvictimdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2