Extracted

• • Target

    5146e65e61c6f24bdcbc7773aa5eb156

  • Size

    987KB

  • MD5

    5146e65e61c6f24bdcbc7773aa5eb156

  • SHA1

    a97a13206540d85a9e37258c9724291b9ee0b848

  • SHA256

    39f09e2c04da023e4fe7faa8cec8c8a687282937452b517a788a9bd78e6b2aee

  • SHA512

    cd665ca5a8c6da6d3cee7a1e81c255876121807ffddd7c25d1eb66a35782fca721ba29efe4f9078c3595b3d5f1c7e3c2d9f4dee25c8950d0912070fb6920d26f

  • SSDEEP

    24576:rEXTtkffMO+aqv1NE/9W4EaknORauZemAo:GxkKU/9HEka

  Score

  10^/10

  darkcometguest16persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2