Extracted

• • Target

    4be3a6686a4ea050f870f1bafb1cb6a63549e525f4215af3ff26a3de545908ffN.exe

  • Size

    520KB

  • MD5

    f27c83ca93b05f487a02bf6729e45c96

  • SHA1

    ed0cad92fff0d485a3e3b2234ea6404350ee4cd1

  • SHA256

    37ad37d2b58bc6bb5f13cbadb8e97b66b7a04541b8bba4a7e8c07c98dd356c26

  • SHA512

    63d5ddcd9d1d0a23e917853cabce96058cd926f06b4d66f4b026b61a577689c687493146321058bdda271e8fd85374586169416d9b5b01b5b53031d8c80570f4

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbL:f9fC3hh29Ya77A90aFtDfT5IMbL

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2