Extracted

• • Target

    1523bb02ea787afa2f5479338cc6be2d674a46122e0b593859f526bed54ff0fd

  • Size

    952KB

  • MD5

    4d13d0f9577e3d1fc570cd8b79b8da00

  • SHA1

    bba18ae3aef52234643053e67e4eff68087f17b0

  • SHA256

    1523bb02ea787afa2f5479338cc6be2d674a46122e0b593859f526bed54ff0fd

  • SHA512

    3f28c970005113fa5306c9ee84a089bb9d821912fbace14ed72936e16354e6e5544d4ba2da46a05a17d70c907cba398d3b45cb93653d0a4224327056d1927dab

  • SSDEEP

    12288:byyy7Z3z4I8NXOGjwwG/ZjXsAHHz79p9NM5Tz103j2CF4TxQUOfhVPOSAE//VAci:baCI2OewFJN4mkxyHnnew1SatLRzD

  Score

  10^/10

  darkcomet010persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2