Extracted

• • Target

    00a7315ca51b02d71bf5434394f9e31eeb548b91d3ca81237113f5fa31d79af8N

  • Size

    520KB

  • MD5

    dbb090ec4e1cd4892d48a9c268cdf270

  • SHA1

    39560c09165e1ae42ceebba3768409a51c7c2060

  • SHA256

    00a7315ca51b02d71bf5434394f9e31eeb548b91d3ca81237113f5fa31d79af8

  • SHA512

    a6e3ef3ea3418bc253e685dcc81d994e7188a59df43f434d7c5b5d933a36f29e27af8dece18aa7ca88c8bd5194da577c2707662539e752327fd45b4a022f4a9b

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbR:f9fC3hh29Ya77A90aFtDfT5IMbR

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2