Extracted

• • Target

    b79da754145337d758de451bca3553d3f91cbe9e109be1d22047eaec613d54f1N.exe

  • Size

    520KB

  • MD5

    c67c2c9a29f3fa23769ac044b83a0b80

  • SHA1

    4234fff35b88e9ebf5eea74133c56c4cdc112c70

  • SHA256

    b79da754145337d758de451bca3553d3f91cbe9e109be1d22047eaec613d54f1

  • SHA512

    b1ba2e9e95517c1c3dded027c4d8448655f8f2bfc757aff74435e89c3f5cd427fb231938dc27208c9b1fec760713ccbd5b1dd1905db37f59a2316392a00a8b62

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbb:f9fC3hh29Ya77A90aFtDfT5IMbb

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2