Extracted

• • Target

    1109beeb061d774b0a516ea4385f029390c24de0ccc2afd56ecd9c5cb3093630N

  • Size

    520KB

  • MD5

    ba49416551a9167e624a8edbfa630140

  • SHA1

    1ba7883e87d8841dfb2fd33dfce3aa08f4ddcef2

  • SHA256

    1109beeb061d774b0a516ea4385f029390c24de0ccc2afd56ecd9c5cb3093630

  • SHA512

    facf64b14db184efb38646d65431c993a0647790187c7fb218b434fee92afd0d3c5bec5e914272fd7920e52d8dea5e67586caae175a196345ceedfa68d905247

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb+:f9fC3hh29Ya77A90aFtDfT5IMb+

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2