Extracted

• • Target

    4cd3d8089e8022eff724e28c0f389b20a921cb500f0d193d74f5cc97ad0d3381.exe

  • Size

    282KB

  • MD5

    38a67b2fa87a6d49c5fed725ef7cc3e6

  • SHA1

    49b608056a135553bb06046e5bd03d118661648a

  • SHA256

    4cd3d8089e8022eff724e28c0f389b20a921cb500f0d193d74f5cc97ad0d3381

  • SHA512

    9daac628212a599ab53e711b2bebc53d32c72cf6d21e5fc106e3898fdc4ed3693fca4dee0dac1b1352ccb359fafde2d76f4590f250ef65821ea4ab60b2687da6

  • SSDEEP

    6144:Q7DuIRToyeNNkwLq/oCjEqfZgDQJa342ERAiU8AIHHA+K:kTo1ZqfjEGZiMRAiU+HAT

  Score

  10^/10

  darkcometrsdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2