Extracted

• • Target

    3625d3f330c6e1a09237d12f061498c29f45d8084e50b603cb314d0017066d8e.exe

  • Size

    520KB

  • MD5

    01996f17848d79b3f8c43d67dd4f5b50

  • SHA1

    25b5c0c0083c79db3844ec50ee1566d7801d1a42

  • SHA256

    3625d3f330c6e1a09237d12f061498c29f45d8084e50b603cb314d0017066d8e

  • SHA512

    916b4c777cf1ae0988c7e8dad50dbf0f6daf509bbba4c7aad3af29a2c186a1fb4ccf54a3dd5fbb4b6961067c210db231e5ef2a5dffc6afe98da518e957dd54f3

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb4:f9fC3hh29Ya77A90aFtDfT5IMb4

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2