Extracted

• • Target

    cbb9963d25ed9878a8d94703f6687164b4652dde6705bed732c7494f3968f051N.exe

  • Size

    520KB

  • MD5

    a72a5a91dc86a5d585d6f3b6ada76260

  • SHA1

    0e62d8aa5d2edebaa7ea75c591727b9a3832fb8e

  • SHA256

    cbb9963d25ed9878a8d94703f6687164b4652dde6705bed732c7494f3968f051

  • SHA512

    6c6fc2933229cfba09de38f38f149f8903d4b7e36552818d47e79227fd5a96e5e44a32b08cfafda613cf181e41f1167bbde60f3672e0154764e0ac1e53cd312e

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb4:f9fC3hh29Ya77A90aFtDfT5IMb4

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2