Extracted

• • Target

    c14b626c5da14b43e563abc1eb9b0b310872a3415787a6ed7e715a807c7a7522.exe

  • Size

    520KB

  • MD5

    79a1339f17d3d6e4d817800960259783

  • SHA1

    c7d65762a6b558c08ddbee8a316e5ad7b2efe574

  • SHA256

    c14b626c5da14b43e563abc1eb9b0b310872a3415787a6ed7e715a807c7a7522

  • SHA512

    eadd2ba0962a2f274e1e87235632608e3117c2d0e13e6b4a377e975ad86297fc0ec5b8345e24f82bd3ab1a019d6e721cdf32f14032d933ca2b334682d9022ac6

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbl:f9fC3hh29Ya77A90aFtDfT5IMbl

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2