Extracted

• • Target

    fdcc1125280d4a5de64bb9d9aa4b035ab67ed5b823c2f206f3469593d8317160

  • Size

    520KB

  • MD5

    4d2a1ccacb5b6701eff72c44c0ad0e3a

  • SHA1

    3f4d593feb1636a938f374319924c29b3a4fe894

  • SHA256

    fdcc1125280d4a5de64bb9d9aa4b035ab67ed5b823c2f206f3469593d8317160

  • SHA512

    4b37a9a11545813b8e60a97aad73c4580de3330cc953e98eeb93a103d626128a41321a930cb98b97062e1f2506c5654e6104ef9dd5b459678b288dc054f33cb6

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbQ:f9fC3hh29Ya77A90aFtDfT5IMbQ

  Score

  10^/10

  darkcometprivateeyediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2