Extracted

• • Target

    b8f9e6fd17dec2e0a2569c79965f3127370089bd48c3f20871b5c79430060893N

  • Size

    520KB

  • MD5

    74b0b03fff3d28b89f0e8027d8142530

  • SHA1

    4c8d197f26635b263ac7200b9d0c8283b1d07351

  • SHA256

    b8f9e6fd17dec2e0a2569c79965f3127370089bd48c3f20871b5c79430060893

  • SHA512

    0922391e521f1b656230016382a2a684c9cbe96f45a5a291c99b93ee508c4d9344423c1144b37a968db94fa96ddc14213a16c2926c6f12c32dd59d87d9227856

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbQ:f9fC3hh29Ya77A90aFtDfT5IMbQ

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2