Extracted

• • Target

    76324f384652d23dbe3276465aecee4dfcf30ab4dba44613ae338660210294aa.exe

  • Size

    520KB

  • MD5

    15dd16047e0b9525ba0ae5f72f97c749

  • SHA1

    a30ed37aefbe3e1a6f18a2188ca7a8be55ffd2e7

  • SHA256

    76324f384652d23dbe3276465aecee4dfcf30ab4dba44613ae338660210294aa

  • SHA512

    e75f6c3a201a78f99336c257e8594a62d926d16cfafa70d1586c8ea972898385cac72842ac3b6bc258d194b7ab6b415a0e6210108601d1ae13a6393c9563f34d

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbp:f9fC3hh29Ya77A90aFtDfT5IMbp

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2