Extracted

• • Target

    da8b7400c560ffa402c051d820c245fe60922a49a3edb6db52a2a99112d46e54.exe

  • Size

    520KB

  • MD5

    a266f8d1087fdb7528c2c62a998be548

  • SHA1

    e4e313389b5ab5b452f5d7cd7c67a5aade214f4d

  • SHA256

    da8b7400c560ffa402c051d820c245fe60922a49a3edb6db52a2a99112d46e54

  • SHA512

    9832baeeb05a537a9778681d22c7e2f897081510cdc94a2b1c96ae1fa4d6d7c89f22f92b86c4c43dd2d74de28cf9789f8caeafa15fdd9bf515e7beeb48bc7e65

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbJ:f9fC3hh29Ya77A90aFtDfT5IMbJ

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2