Extracted

• • Target

    5010de02eda0f74b84b37e9a4de9e03f5f41ade58b59b2736daab18534629a74

  • Size

    520KB

  • MD5

    009fd70d290e50bbed6097be443e1d49

  • SHA1

    850f525bc23b9cf1849fbb497be19e570cf016f3

  • SHA256

    5010de02eda0f74b84b37e9a4de9e03f5f41ade58b59b2736daab18534629a74

  • SHA512

    816878fe772b739cc938c23272ec19fe2abded670cd8a39930a52a3b44126ff132a685016206c49f241e06cb8938030f39e7cc055f7de08d7a16014b7e8ecc3f

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbJ:f9fC3hh29Ya77A90aFtDfT5IMbJ

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2