Extracted

• • Target

    JaffaCakes118_395851a1dbc8315b3182919d6d8925e0

  • Size

    728KB

  • MD5

    395851a1dbc8315b3182919d6d8925e0

  • SHA1

    849d388b6851b693a51e9584b5f9cb4be77ff745

  • SHA256

    9cfd6e0302b2dc37c738a45e62fbc23f078455cfd02e22f2987c68fe565d7454

  • SHA512

    89ebeb10afb298ffea1d8957cd861d4593292b36d2e127146579c3a8ac534d839a6db4c35b94b3ad44d8a1daad38e730611e04806e058ff53a3da0fbbae7a055

  • SSDEEP

    12288:7iLERtSJj3culKz/LXzqCFeJ8eAQlfmO8hzrFsaCT6xwb2T99X//Mbt:71ij3cJzTXz/Ub8NYmxxTnX

  Score

  10^/10

  darkcometdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2