Extracted

• • Target

    671aaaa3987ae62363072f9219417ebd913c76751ddd893b4e07940a90868d1eN.exe

  • Size

    520KB

  • MD5

    432115ab250f999b8c65e4893abbbcb0

  • SHA1

    6932aab2652e45e7318dfd3da127717395990408

  • SHA256

    671aaaa3987ae62363072f9219417ebd913c76751ddd893b4e07940a90868d1e

  • SHA512

    7fd3a5860a69258b4022cc4205b5a875ddf8c792ae14d916bd20636cb0149a795f12bdc2fa43620f4f9aaeef86e1ca74d2529fb9f76a0ca3b0117e5678247a98

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbf:f9fC3hh29Ya77A90aFtDfT5IMbf

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2