Extracted

• • Target

    01bf13a6e114429aa1a7cc6e8eddc8fb19965bb9832a5197d7724d671aeb33dd.exe

  • Size

    1.7MB

  • MD5

    758543c7742ff270dcb530cffaf11eeb

  • SHA1

    6d1ed43c34365897efcfe903c1214cb714632176

  • SHA256

    01bf13a6e114429aa1a7cc6e8eddc8fb19965bb9832a5197d7724d671aeb33dd

  • SHA512

    2d1e81f80077cd0876f80086a8e0e941c8846102a7603eff3f9f71af86cd9feb37cb339cb35a15ac6f12e11c9dd602f8e18846caeed8252a40d159ed3f515817

  • SSDEEP

    24576:qMyptg5dkAmL8jyLQLNW0yzotcSHVZwMz8gkyJ8fPd:3te3d

  Score

  10^/10

  darkcomet1discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2