Extracted

• • Target

    4be3a6686a4ea050f870f1bafb1cb6a63549e525f4215af3ff26a3de545908ffN

  • Size

    520KB

  • MD5

    de36061ff28a39f72982ba16a836aab0

  • SHA1

    dbae1d7cf090303969b2f8e3a5938b56d11ec316

  • SHA256

    4be3a6686a4ea050f870f1bafb1cb6a63549e525f4215af3ff26a3de545908ff

  • SHA512

    5a56dce02829d675173cf6a7e9afcbcbd6b18708d8c25123ed730275610ff122d364549ba46ed420253b506b13d309a951a4e9cc48a39a3447d3be9597e02201

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbi:f9fC3hh29Ya77A90aFtDfT5IMbi

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2