Extracted

• • Target

    1dba91ed96b54ccb478d114990a4c7661b5e6b2be8ea8c6f180915aafcd1cdd7

  • Size

    952KB

  • MD5

    0795df23de1c401e96a153b026ed8600

  • SHA1

    b4e1861b4579634e16b4c93578176f336c7de5a2

  • SHA256

    1dba91ed96b54ccb478d114990a4c7661b5e6b2be8ea8c6f180915aafcd1cdd7

  • SHA512

    099e715551d5ddd10b7a0e313e4c220396f360cf5cfed39922242fe38031efed4940ef524386582575f46a413f0ec27c69617298022f2bb3523ee1d005357e97

  • SSDEEP

    12288:byyy7Z3z4I8NXOGjwwG/ZjXsAHHz79p9NM5Tz103j2CF4TxQUOfhVPOSAE//VAci:baCI2OewFJN4mkxyHnnew1SatLRzD

  Score

  10^/10

  darkcomet010persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2