Extracted

• • Target

    582777d7e6278c2fb27bfbbff612f6c6d20d5950f37cd51b83e5c87cc45b49d3.exe

  • Size

    520KB

  • MD5

    0cec10f543c918424a1c7d4443ce15cd

  • SHA1

    a276d1f10d2c8c3bfade2eaee55968f765c2e2aa

  • SHA256

    582777d7e6278c2fb27bfbbff612f6c6d20d5950f37cd51b83e5c87cc45b49d3

  • SHA512

    7733d3c5c8ee1816fcb69348679959448429db302ea96c3ae7d4663bc0bcf364679a374c25e319e473fa3d88dddcddffca47d409a549a4cd675475900bb1110c

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb0:f9fC3hh29Ya77A90aFtDfT5IMb0

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2