Extracted

• • Target

    6f89c8628344cf8f8c8cda716f432b2efa3204b5b7c51492509ee5233cacca1bN.exe

  • Size

    1.7MB

  • MD5

    7401a33cbb76ea99fa54a8420b3be420

  • SHA1

    6351cae2ac6e773bb6d43618fe47294e48cf6e0c

  • SHA256

    6f89c8628344cf8f8c8cda716f432b2efa3204b5b7c51492509ee5233cacca1b

  • SHA512

    5632d90652ee1c7c00e7563a488e3403cf91f9ebafd4a43d34ee83a1f04e18ee6a5fe7a1fe0db7de1e398c974c89d212407f7f9711d334fd7057cc919681bab4

  • SSDEEP

    24576:qMyptg5dkAmL8jyLQLNW0yzotcSHVZwMz8gkyJ8fPO:3te3O

  Score

  10^/10

  darkcomet1discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2