Extracted

• • Target

    4289fa9e7ca43ffbd1073e135bc15e19be073f687929db9f763af25259003053N

  • Size

    520KB

  • MD5

    c864b287c41d4b3e6a2487c05a88da60

  • SHA1

    95f73baa0894ab1c6cab25e04fb05e4d3062cc14

  • SHA256

    4289fa9e7ca43ffbd1073e135bc15e19be073f687929db9f763af25259003053

  • SHA512

    2e6f8a95877bff15f045849cb91b494aa16aaf5f84e5d5b67e0dd524f845040af0ae8ef76b8db48ff5702dfab4cfcb8d7275a7682ff86735b7700660ed5de661

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbK:f9fC3hh29Ya77A90aFtDfT5IMbK

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2