Extracted

Extracted

• • Target

    JaffaCakes118_33dc3245667316baa6718526b8378920

  • Size

    738KB

  • MD5

    33dc3245667316baa6718526b8378920

  • SHA1

    e3a33ca4dd8e7c20e1dc38239bb94b341882209d

  • SHA256

    99b5eef629934b4c61bb544f3ac52c6d8e6c7d4f8dcdff2b4c0f68bce95ac968

  • SHA512

    91aef173732e91a0cd6e70ed89981a741cb0b0a47c4341612633cd32a81c8d30367cfd9d374e079ed825ff85cee455f87c0c9f1c987a9cea4eaaa5d5ceca405f

  • SSDEEP

    12288:S9hV3300UaiqLQU7hhTRBYvmTAJ6YzdvmIeWZPsW1BHC2AKa2SQWfDFq4:SJ3jiMPthTwe0nOWZzRm/QWfBf

  Score

  10^/10

  darkcometzadrotdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2