Extracted

• • Target

    8c9ff44e17e358515172280af70a9017cbf44e937146922750147476486e5d71

  • Size

    520KB

  • MD5

    a005168ca78727676148bcd8a93047de

  • SHA1

    640b8c6ddeafb34f244584f99d779dd5c8cb4de2

  • SHA256

    8c9ff44e17e358515172280af70a9017cbf44e937146922750147476486e5d71

  • SHA512

    6b84ba7944b2c8bff3037ccad0974a2ff8f8cf9a60576f9fd3c771c43f6e91e3680e9c015a8e0007a084a0a414213f07ad9845f650a5518e5c77563c1fff8131

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb4:f9fC3hh29Ya77A90aFtDfT5IMb4

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2