Extracted

• • Target

    a6e85e9a4ced3b3473dbee2fba88ba9bf691752a10ef05b7a17af211403b8063

  • Size

    2.0MB

  • MD5

    094d2ed28ba8f460f483e365585b7644

  • SHA1

    bf660d49ad1adc3ae596cf21683509dbbf89e9bc

  • SHA256

    a6e85e9a4ced3b3473dbee2fba88ba9bf691752a10ef05b7a17af211403b8063

  • SHA512

    8c35b7123e338a4cbd590ab7873146e094a98e06d1a631f6bdf2fa5e747696ea36adfe5306e5a8e388b7e6a4ce0d28632b67cdfe545bbb46c26b8dee39034255

  • SSDEEP

    49152:VkTgAdLELdDvSlMLMvvddF2kwJye6TsHWSXI1AWYnEh:VpAdLyd4MLevckGVVHWOI1/yU

  Score

  10^/10

  darkcometisrstealeropfercollectionpersistenceratstealertrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

    trojanstealerisrstealer

  • ISR Stealer payload

  • Modifies WinLogon for persistence

    persistence

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2