Extracted

• • Target

    46dd4bd57b1a79b0cd006e9157c909f0N.exe

  • Size

    324KB

  • MD5

    46dd4bd57b1a79b0cd006e9157c909f0

  • SHA1

    c2b18df0be98864ce174846cdeed8b22d37cf943

  • SHA256

    2198b1e583ed283cedcd9e5d4031d905400fff6e52fb54fe129094524aa588b3

  • SHA512

    e069d5bb65df3c21f5e595ca2351ab35c833aa8e52e549890f53882d8c3c7a312511a6656c85f2eee2479d8d1811b52aa80b2394495b79a7ddb66950428257ca

  • SSDEEP

    6144:cvhFCYZdP5aHNn1s7C+3S4R5wQrV/YbZwZ3ssu4eqswN8s1Pf4NAGy5uRyXR6P+R:TQdwHNn1OCN4MQEZwUqsA

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2