Extracted

• • Target

    e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe

  • Size

    520KB

  • MD5

    defa927413115841c913a0dc61e33ece

  • SHA1

    bc20f836b27a4b743c27f46ed598a1e35bed7243

  • SHA256

    e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec

  • SHA512

    9a863e646167403c0bbd8345359e3386e87a3b45904d0f23867a4b25ab9060a940e81ebdbf4df3788be3eb8260dd27650c409cf945c16914d08f23b676296be4

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbG:f9fC3hh29Ya77A90aFtDfT5IMbG

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2