Extracted

• • Target

    f998eebd42b69027db13dc886cc38eed498b06b29b81968efebe4a4b2c1c412cN

  • Size

    520KB

  • MD5

    71d6aa005f8301a928a662cd1a29a670

  • SHA1

    1492c92637ea6d8a2fe99f5cd2ee0811ce450088

  • SHA256

    f998eebd42b69027db13dc886cc38eed498b06b29b81968efebe4a4b2c1c412c

  • SHA512

    7bcd890f52f26f3dad3d722f47d33e7647b076cb3326e88a3b0cb3b8ef536ed30783a5e4ee7bde824554a33e1759cde3381e1ee4e1ae20557b272214efe7ee1c

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbv:f9fC3hh29Ya77A90aFtDfT5IMbv

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2