Extracted

Extracted

• • Target

    IMG_WA-D0014/IMG_WA-D0014.exe

  • Size

    1.5MB

  • MD5

    f43802841b34045780b19c44f10652aa

  • SHA1

    8395ff25a349459512b81c26eddff2812c486595

  • SHA256

    e771b871b56ae87849d567a693ac3c01c5f57b737dc74435289425869ae17657

  • SHA512

    c50e5a8c76b27bb3bb50761c7f0b9c8b0535bc604a8f687189048bb69cb903d896eb2931ab585d77c1493daec83c8369fc7f1d3ea5c7d5549fb28da2d9fb8eab

  Score

  10^/10

  darkcometoct 29 19persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    IMG_WA-D0014/IMG_WA-L0015.exe

  • Size

    1.3MB

  • MD5

    c8676a515bba78010744899b6df2c877

  • SHA1

    49b73523343f90b946176ce897318eb6636547ad

  • SHA256

    597495dd0d1b7eb2215a9627a337c1a1f7031fee38c7d6e6863b87d24f194814

  • SHA512

    0977dc43c8f09738672470ef9a7113607184df854fb802a67911fd6ce450bfc8eb0b95c991c812c91fa74d7ef93965c6c84fb6468b34044dee0946db7bbcbe02

  Score

  10^/10

  lokibotcollectionpersistencespywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4