Extracted

• • Target

    734478e466032b203f7777fc9154fa18ab78879ddff88007554661a2ae15322eN

  • Size

    520KB

  • MD5

    ead518469e56fd742ed1955f744285e0

  • SHA1

    d78a93bc65d01bbb505f58031a74a9a7219bd434

  • SHA256

    734478e466032b203f7777fc9154fa18ab78879ddff88007554661a2ae15322e

  • SHA512

    cb4f39e081d400169d721a501ed97a094fb0a18b6980b4c8a60b4fa5c1da5be91bf5517ddb35b1e71d0f205c5e218ff74e71ecd435fb8bce105afe92c0cae3bf

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbL:f9fC3hh29Ya77A90aFtDfT5IMbL

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2