Extracted

• • Target

    f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810

  • Size

    911KB

  • MD5

    18e4e38984edab5ab98764bb562beaac

  • SHA1

    5a1cc294d0ab762d8caa26b4b880982e3ee26096

  • SHA256

    f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810

  • SHA512

    e6afa794467c8183cc80c4570388bf50d8b64c0bbb2bbdeabdcebb59904343369f2434cdbb224215ce86a451b6e0f631edc82a02c295a5fc12ed93ef783f605e

  • SSDEEP

    24576:0fQkTf4smJa44JspYmcis7jKvN8Pu/lHCHgYZgq3qXv:JkTgsLs+mcv8N8P8JCHgu6f

  Score

  10^/10

  darkcometslavepersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2