Extracted

• • Target

    d172679e08b720d86c0bf850612d5b6c3c85f41b3605701e2e19d2b6e5a8425bN.exe

  • Size

    520KB

  • MD5

    8aa060a42822fb2f56e0dc00689cdf00

  • SHA1

    22ea29f7f24c591e62d3a74f07f859a17fbb9e0f

  • SHA256

    d172679e08b720d86c0bf850612d5b6c3c85f41b3605701e2e19d2b6e5a8425b

  • SHA512

    056eed58046e1b387cbe85e105d8269b7cb96fd4ae61663e50e36079a4c0a0f4dd499bed86724a04f7d11bc1b1306c12d25c78117434755aa1d1b26fb8ad25be

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbb:f9fC3hh29Ya77A90aFtDfT5IMbb

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1