Extracted

• • Target

    Purchase Order 781.exe

  • Size

    2.0MB

  • MD5

    701fbddfd06ee81cbdd5ef856389aca8

  • SHA1

    f69315ab7caf73bd0d7ced899fdf2e619d3c474e

  • SHA256

    864e6ddd9c09a95df11b80abbaa0b1a9a4fb890cb27ad21883f44853094bb0cd

  • SHA512

    cdcadf2dcf3ba2fb640a00e8f9751d3c6f08c34a70c0ca441795ba9e59de3c323549b0180d7b940395f1d2800cda06672e2cb040257f0101eb521a2b43e7b0eb

  Score

  10^/10

  darkcometmay 2021evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2