Extracted

Extracted

• • Target

    Ultimate Password Hacker 2011/Ultimate Password Hacker 2011.exe

  • Size

    2.4MB

  • MD5

    bdd0969fee3780c98c0bc55db4362ab5

  • SHA1

    8f8712d061170a6baad9b6dec57cdfe727bd4886

  • SHA256

    aed0d29605b857b18bade968b956cea5e275fc31592c8e4cdd7406abdc1937ad

  • SHA512

    aa59de5cd64913a20dbf5b5805f76c4e4789ec97d072a328a1b7cd6f0ca9201fc6ae249b71798fa4c2b31faa3c190da98d25777fe3c2fa46ee6b23009501ed9f

  • SSDEEP

    49152:oH2hEobT22ZmDhEKhEiCfbEZq4CKP5ErJ:8K

  Score

  10^/10

  darkcometxtremeratguest16discoveryevasionpersistenceratspywaretrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2