Extracted

• • Target

    3f129fa0acb200fa9578a6051845fa2375a67235fb9111371e3021fb047ebc86N.exe

  • Size

    520KB

  • MD5

    5b7b75ede2d95831c1c305ca4c4d3520

  • SHA1

    e2c745d66b03313fb37f06bfe736a4278ad3cb13

  • SHA256

    3f129fa0acb200fa9578a6051845fa2375a67235fb9111371e3021fb047ebc86

  • SHA512

    19a9ef38f443c7ba507fd4269e8d72a40927ee95a27fd254ee1fb6531df54b91e55c14a11ca6edb9145f0a37c36282a4c1c680246ad4a385c1138a57a4c3858f

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbC:f9fC3hh29Ya77A90aFtDfT5IMbC

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2