Extracted

• • Target

    1e177bb6591daf06a0dafc378093c04669403a90fda3e539ca4a1aa2a67c7c11N.exe

  • Size

    1.7MB

  • MD5

    4a45eda053a2e6ca140a58d2dcba5ff0

  • SHA1

    fa5bcdcb373d8dce86ae6bcc4ed4770ab4498b5d

  • SHA256

    1e177bb6591daf06a0dafc378093c04669403a90fda3e539ca4a1aa2a67c7c11

  • SHA512

    89fdba17a8750c85b3488492e1968a2ae7bc876552a558f84cd6ecee6582ee360112abe580fa0dab0005824f09695b4f8b114a4e2f09e12bad4f7030c14a416b

  • SSDEEP

    49152:kOBuzw/nMVpcq/2ELfWum/+kD+MKklDvjao:kOuzwMobEKpDVKabjao

  Score

  10^/10

  darkcomet093012dediscoveryexploitpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Possible privilege escalation attempt

    exploit

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2