Extracted

• • Target

    JaffaCakes118_c0295404b7677140fb0a140dd0aca4e2

  • Size

    1.0MB

  • MD5

    c0295404b7677140fb0a140dd0aca4e2

  • SHA1

    d9335d5d88d9c310e1457142c3b6f0a3d0a91819

  • SHA256

    6d481b29bc81dc85cbe5ba4a8b82224d1b3dc0b8dadb012f5f92f4c8e4a14db6

  • SHA512

    38c6f47249622019d129eef71bc38f981532c921044f3e00c440315a1536813efabd3d1adeba10856004b8b0622ec63cec16cfae068bcf306310b967aac0a7c4

  • SSDEEP

    12288:hJJPMPW54G8MRdYXRYgse02EC50RHZm9dGvF1Q7ylaX57R6BhkdPM2K3Dg4WHOuN:Hxe04IeYq1EZJ9B+t5hLc3tZ2j

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2