Extracted

• • Target

    f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc

  • Size

    520KB

  • MD5

    17705720e760c663115260a1693becc3

  • SHA1

    444d41ab035b90b971cbc7df34a9c0fac6069c04

  • SHA256

    f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc

  • SHA512

    c1b582123b9e99a6c301652ed9103d43eefeb0ff831069e399d23bf4ee33c581799224bedae6a1dd639a936d22414722f08b6768c5855c410da084cd418c8e6c

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbm:f9fC3hh29Ya77A90aFtDfT5IMbm

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2