Extracted

• • Target

    7122fdb607392a4805afb8271355b331718f642a06e8df5bc86ec8d2ad53b697.exe

  • Size

    520KB

  • MD5

    feb6bf93671559e74b626e8b88e80626

  • SHA1

    effe88b5d988256431c78cf837f849952fd4b1ce

  • SHA256

    7122fdb607392a4805afb8271355b331718f642a06e8df5bc86ec8d2ad53b697

  • SHA512

    bef5f9fa450f30a62bdf04020ff3c9e05b8d87a5ea6740ba50d5bf869e3f6919a623c62ddc9d228fe22a0556cb0125e10da2045ff0330f53254990fac6e6ceef

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb+:f9fC3hh29Ya77A90aFtDfT5IMb+

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2