Extracted

• • Target

    917879ec8d86c7262fc758d8f3fb1153dd3d04f003812e4748b13ee3f6d5da1c

  • Size

    520KB

  • MD5

    3bdc5ddad06f63a72016d133ba2f118d

  • SHA1

    b9b180f3f9e7fcb5f37063b1761673cbce27ca2a

  • SHA256

    917879ec8d86c7262fc758d8f3fb1153dd3d04f003812e4748b13ee3f6d5da1c

  • SHA512

    581d37cde0df25c0f463e5cae287f688c52e5e0542a1a9f3e4df14076f8067889797888623ca9eeba712f27d2ce48e40770768a97dd52c2257d63a982876f0d5

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbA:f9fC3hh29Ya77A90aFtDfT5IMbA

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2