Extracted

• • Target

    2414bd38a2d0487be1f1a047dbb42353258489bf7a2768cb4ddd6527a85087bc

  • Size

    520KB

  • MD5

    2f77c304e81533f8380275e5377c112b

  • SHA1

    68716a22f7f17fe9d3bd085d1b8e79ef978b001f

  • SHA256

    2414bd38a2d0487be1f1a047dbb42353258489bf7a2768cb4ddd6527a85087bc

  • SHA512

    fb5c686ee15d66898f4f2772cf38d2f2ec4560a6a7670ce3f779c4c3865882a70fed1e91d4331f2029d323c5e9e902f0127d19e81c4f0d78d9d4a4caa6a2865a

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbA:f9fC3hh29Ya77A90aFtDfT5IMbA

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2