Extracted

• • Target

    ac1f09d0a797d231ac40d98c74851efbb1325d8c6351ddc251e0369c2f20c0ac

  • Size

    324KB

  • MD5

    1da9d5eb17a25c1dcd2d7028867904aa

  • SHA1

    b75ab89bcf8306b9ef6d222478a004aba32ecd7f

  • SHA256

    ac1f09d0a797d231ac40d98c74851efbb1325d8c6351ddc251e0369c2f20c0ac

  • SHA512

    68b49d817d381fdd4d108f9b86c8aeb4a743000247878412c30d671be78d9eb3c019db62a4cc61f207e556389b9b3ff012f1e4c77d822ea42132f6aa292a94d2

  • SSDEEP

    6144:cvhFCYZdP5aHNn1s7C+3S4R5wQrV/YbZwZ3ssu4eqswN8s1Pf4NAGy5uRyXR6P+R:TQdwHNn1OCN4MQEZwUqsA

  Score

  10^/10

  darkcometguest16persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2