Extracted

• • Target

    JaffaCakes118_c00d926b10ad42ff26efe51757c9c82b

  • Size

    1.6MB

  • MD5

    c00d926b10ad42ff26efe51757c9c82b

  • SHA1

    0ad155a77754dc180690f6f53c166d50e7ebfe8f

  • SHA256

    6f6703cd07e74933c1218398be6766a6f1ff996ed19774104bb14653d86bffc8

  • SHA512

    e5cdce480e7b4b411959a7c44effa8c78f22be7ee433863c18e243a57907c0a68dd95960e8437f8c7aa9081b3430fd3a8453e58f4700c55a187ff34f3fd53388

  • SSDEEP

    49152:fRMIu+CNVXuj0qXPqXTSCNVXuj0qXPqXTC:SIudOjbPqjpOjbPqjC

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Program crash

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2