Extracted

• • Target

    c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74

  • Size

    520KB

  • MD5

    8bd5bac79fc049aebe1db767c7f4e8a2

  • SHA1

    0566f6b910c319b8e0cf4783596832ab6855286f

  • SHA256

    c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74

  • SHA512

    16b5dd41b9578b276f5b1231860fe2b779c30252399cf1cc23ae2b0785bdfee989c5ce9b67e9f734723353fbba8d79ddc69b7409ae07001639d2c8a0f37836d9

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbd:f9fC3hh29Ya77A90aFtDfT5IMbd

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2