Extracted

• • Target

    f9c87be6b800302e392ee1644db933638cc0728038f8731de02d4e6177965dad

  • Size

    520KB

  • MD5

    607ffce854561505f0c289268b600c7f

  • SHA1

    8fd0e58e50ac18e3669066a49dee474add33cf9b

  • SHA256

    f9c87be6b800302e392ee1644db933638cc0728038f8731de02d4e6177965dad

  • SHA512

    f5debd7dcd5d43852acf1a00b1e7633eb312e8e6c096c8b6cc225b16e18084aae6adcd42e1c5a052c28b826e7a1d9b8d3bad8ed9c77e2a7c8c5444bb6dc8224a

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbm:f9fC3hh29Ya77A90aFtDfT5IMbm

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2