Extracted

• • Target

    524029180d6e67d204ea0db7c5f8bbd0883d093787f3d6a5914e70f9b6fe04c5.exe

  • Size

    520KB

  • MD5

    b5f9d5be9ef81d9df4c75d1cd858935d

  • SHA1

    f9d069a7caf694868e72d3a966df3d6dd0c1d344

  • SHA256

    524029180d6e67d204ea0db7c5f8bbd0883d093787f3d6a5914e70f9b6fe04c5

  • SHA512

    513b7eddde98d0ce24ed7916a894d0ed204705658f0b6906427b41ab04158f0d7cd6f3c3ae267e11b677462b655567d938aaa254d4647f216c33b92e4331a9b0

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb2:f9fC3hh29Ya77A90aFtDfT5IMb2

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2