Extracted

• • Target

    8258b5e277641a60e091ac32e4ca7d8ddc8d4de565c61f4b4bd54d6472ebaa53

  • Size

    520KB

  • MD5

    818296cd80b27e4dc5b2b94b538e0252

  • SHA1

    330cc71d4b9d915b84d15ff2beee0a12820d9962

  • SHA256

    8258b5e277641a60e091ac32e4ca7d8ddc8d4de565c61f4b4bd54d6472ebaa53

  • SHA512

    56b160fd3f0819066ef61df5c20c769aa99993c03b3f73030d01e3e137f08ba0ecf9c9097a76d10bbd1de57de3f32d40bf41b03c6d860d89571aae0a56d6a1b6

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbT:f9fC3hh29Ya77A90aFtDfT5IMbT

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2