Extracted

• • Target

    57cd5a109c63dabf901fc0076c95138971246f80305dd20675fbee64c1b70476N.exe

  • Size

    520KB

  • MD5

    e8bca826a31021429c0a69228bd6d3a0

  • SHA1

    cb7511bd838dc09a300fdac51e7be78da3bb9417

  • SHA256

    57cd5a109c63dabf901fc0076c95138971246f80305dd20675fbee64c1b70476

  • SHA512

    e0a6b38c11a65d225ced509756db7efd56f7eaff01b0225e6b21ccc8928cbd594f4301f4f09ebd18144deba1b729be5ac99c8a89eabacce2fe8d2b9ea61bc4aa

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbW:f9fC3hh29Ya77A90aFtDfT5IMbW

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2