Extracted

• • Target

    596e34637eabd5e7af8e29a2dfb4f94c58a69d81e9aaa6c3c76c3345eeddd072N

  • Size

    520KB

  • MD5

    edc997ab6c3dab24042b6d6172cb7190

  • SHA1

    c0ec90aec028b25cd2aef1cb5ff5ad1065755bde

  • SHA256

    596e34637eabd5e7af8e29a2dfb4f94c58a69d81e9aaa6c3c76c3345eeddd072

  • SHA512

    228d1167494d8f7d38bc6838d3ce1e4c3139d075a6d9a6f8bdd4fdb0826cf71cbda5c0bdb03932a529f74ef59b0b0e73b1efc593b649a3decf005dd8d64a633d

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb5:f9fC3hh29Ya77A90aFtDfT5IMb5

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2