Extracted

Extracted

• • Target

    JaffaCakes118_8818e6f943ef82f4beb96729f17dea61

  • Size

    937KB

  • MD5

    8818e6f943ef82f4beb96729f17dea61

  • SHA1

    fe4442b52984b2f608b316135fc1e363e6933d2a

  • SHA256

    02c145a91eaba794aa9e8ad821fc525b7639ef403d2ea1174cafc5844087c685

  • SHA512

    15932e956dfcff6240ed65ccb79d55b5fc168ae4037d09707b0adcb9eac42866b91a6395056f7e4c6ebc8b23b0e5983f64adf51bc7ed45cac2966eae9b0523b7

  • SSDEEP

    24576:7E2MYXsfrM6XRnBvCkymIWG5O0v7QLLaN:YYf6hDIWj0v7R

  Score

  10^/10

  darkcometsushidiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2