Extracted

• • Target

    FOTOVERANO15.scr

  • Size

    874KB

  • MD5

    ec692bde91ad1c6e182843bc0a5c7e81

  • SHA1

    54996c1d4aeaf76855b7b73a323b74c191573863

  • SHA256

    de19d8ea2911ff7e337823576e214151ad4426206db8e9ea9880778f2592f935

  • SHA512

    4b4d5b7707071b86cb2d55411766bb3ebde9a8765becdaf5840d78be6e278f5b3d2bbe2888350a4d113c49a65c9b8e2ec818429db91c72529b0fbfd12f9c7dbe

  Score

  10^/10

  darkcometfotoverano15evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2