Extracted

• • Target

    JaffaCakes118_354bebb6ca65b5a9ce3ca38cd550a6ad

  • Size

    1.2MB

  • MD5

    354bebb6ca65b5a9ce3ca38cd550a6ad

  • SHA1

    973e218f6781b8b11c70c12d8f0a5fbb746880de

  • SHA256

    38b24b56e1667c0c223b7c4a86845808a8eeced169eb8d9de86a68c74a09c9de

  • SHA512

    3960c074d3a0b304fabb793b2ca8921e7004fb841c71094f0faf9838c06728a3db7a8d47e01a1b97731852b16bbcf43c92bc41d7e68fea7aaa70ef1bb8390c2c

  • SSDEEP

    24576:T5Xl0JEQeEouJIauCVtS2NE/obVox/zZQDQ1mB:H4lhJVucI8CGVGZQDemB

  Score

  10^/10

  darkcometdiscoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2