Extracted

• • Target

    5ca4e0ff5d89afc615b182b55b62398caef27525dd6ba7827c44fb7e1ed138c6N.exe

  • Size

    520KB

  • MD5

    ef9bde652f3f2ef3dd6899cb39e48130

  • SHA1

    c6a2673bb81ea5df6126c0ce486464f9ffc2545d

  • SHA256

    5ca4e0ff5d89afc615b182b55b62398caef27525dd6ba7827c44fb7e1ed138c6

  • SHA512

    9e30484886e7d8a3063378c0d31a95409717a1ebd0b49eb4ea719788b39cff0ecad53974a7fe7b56bd832a862c37fa00cea2afc65ee1160e434f2da9efe4a9df

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbh:f9fC3hh29Ya77A90aFtDfT5IMbh

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2