Extracted

• • Target

    de25250f2f57f4e9dcedbdc653baafd2ee60e87e8d5523ac1221a80df5ef055eN

  • Size

    520KB

  • MD5

    c3697e13cbc8f1fa7f4c46bc740ba6e0

  • SHA1

    32113cf10c01b6b453647acbb1a6958939f7234c

  • SHA256

    de25250f2f57f4e9dcedbdc653baafd2ee60e87e8d5523ac1221a80df5ef055e

  • SHA512

    3dd534b3a259963848eb4ce55443589c174f3bca01015e6f3932364255275f3dab8bb8720176413280a8520608d501111f0d803834b22bdb37adbff7ee266e70

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbJ:f9fC3hh29Ya77A90aFtDfT5IMbJ

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2