Extracted

• • Target

    420087ddaaf5578b26d61291910d03fc

  • Size

    520KB

  • MD5

    420087ddaaf5578b26d61291910d03fc

  • SHA1

    d9eccf31814382074458200ee7fd596a1376e9f5

  • SHA256

    874aa6240f3cb3b9ca5e00f75c7b2699e873366db583785b4b23368525542e10

  • SHA512

    c61f063562011b97f941a79d48f7b4e8f6ca3f2eaf217bfaec5cbeab85e92cb2e98f4b1c3ae8b46e2c7a4dd68e94f225f54d65afb3533c705d1afa5faa2a6ff9

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbJ:f9fC3hh29Ya77A90aFtDfT5IMbJ

  Score

  10^/10

  darkcometprivateeyepersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2