Extracted

• • Target

    59fdbe976e9178c52e3a198033e704c0_NEAS

  • Size

    520KB

  • MD5

    59fdbe976e9178c52e3a198033e704c0

  • SHA1

    26c1e75c0379f371b606e4e925d0a427f6f220dc

  • SHA256

    9a8e189802856de4155551c6f660428a41fae421188376102cc8795de6615409

  • SHA512

    ef9a59734961e683c5d55945dccdd917c25d42e9208f7e70ec2bb09efb6ab8a720efb2fc783cf1fa4cdab138e9ba77fd2b178dc2f9b6934cd5c1c2feadbd67b8

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbI:f9fC3hh29Ya77A90aFtDfT5IMbI

  Score

  10^/10

  darkcometprivateeyepersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2