Extracted

• • Target

    2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492

  • Size

    520KB

  • MD5

    5e0b2bc839de9893f2c78ecd5d53ab88

  • SHA1

    588785a0d25f6a34e9fc1499364e10f9e0b83338

  • SHA256

    2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492

  • SHA512

    5b8556aaeaa8fb0c9626e546dc5f7a0b4f39a4e92b0973b4a896e0a595cf424a46d37024ccefed641c582d31ee448df95c77d07b2a2f52441d507f8ba3124a3d

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbq:f9fC3hh29Ya77A90aFtDfT5IMbq

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2