Extracted

• • Target

    b3fdd38a2a2283e52257a15180117f5fb6160992069cf14d72da61215ee5c007N.exe

  • Size

    520KB

  • MD5

    3ff9c73f165440d7017a076dd9498f00

  • SHA1

    b0ac814458edecb71785e05a20eac1df1b23ad26

  • SHA256

    b3fdd38a2a2283e52257a15180117f5fb6160992069cf14d72da61215ee5c007

  • SHA512

    6f32bd847f46db1dee28b11841d8de7743e4dfe858bc0844da9285d0acdd10ecf8c54d8c73f66c4c309e3ab8206b9885f4b68b334d2f6c4eca225f26a2ec4bf9

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbm:f9fC3hh29Ya77A90aFtDfT5IMbm

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2