Extracted

• • Target

    a1a5b5e24c9565fe290da7d5f4082b156e7ad9793d56b69d3da08596c9119cf2N

  • Size

    520KB

  • MD5

    b10b3441cfac9871aec850af5e1fcc90

  • SHA1

    8c67acd3b64b66eebfe8bb418cd981db728861f6

  • SHA256

    a1a5b5e24c9565fe290da7d5f4082b156e7ad9793d56b69d3da08596c9119cf2

  • SHA512

    f07dc79ee0dfa50009f18afe2ae462e5023818cd755d0ea34f3267f4975fb09107836b0b40dea0ce727ac64806ac8e44e90856363aaa51651b585c44236bf83d

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbO:f9fC3hh29Ya77A90aFtDfT5IMbO

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2