Extracted

• • Target

    354e7c77e46144d71b496b4ff182fdc6c55a993a7de7a9f42448754299afc40d.exe

  • Size

    520KB

  • MD5

    e18ab3843fa32dd1daf0575f3831fb17

  • SHA1

    115854eaa8e45adcd9e3a863bd9872349cfe90d3

  • SHA256

    354e7c77e46144d71b496b4ff182fdc6c55a993a7de7a9f42448754299afc40d

  • SHA512

    66f809581db6ee5cdfad8c32391e330e29b72ea51ec47dab0fc978b999ab5b918c63dea58f11e0be11400191e87e939257893bcdffc4f9e22e7b99ff561932e4

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb4:f9fC3hh29Ya77A90aFtDfT5IMb4

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2