Extracted

• • Target

    20057c4e74e6e3613608a7734ac561b367de340292a38cb2c363bc7adc96f62eN.exe

  • Size

    520KB

  • MD5

    70b16458e59c940f6acadbd53c5e0c10

  • SHA1

    826647f23ca8ec802f6687f6d1140322f867610f

  • SHA256

    20057c4e74e6e3613608a7734ac561b367de340292a38cb2c363bc7adc96f62e

  • SHA512

    8ea731fb6bc21c34dafd739231e88f342bc30beb4e8c62ca6040fcce138b17440d714d4d573a24cf00a4fe153b214394db5d10a6cf628ba0ccba34b3b1b1aeb9

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbx:f9fC3hh29Ya77A90aFtDfT5IMbx

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2