Extracted

• • Target

    bb40056172a6e0a4d5c39fcfc445bb4450ae90e5bc085482a67ca0a02e0c6059

  • Size

    340KB

  • MD5

    651a7cc3a3b7d279929b20b7b3d6affd

  • SHA1

    db6607d408be3e1d25076725b1af8f048a79fc7a

  • SHA256

    bb40056172a6e0a4d5c39fcfc445bb4450ae90e5bc085482a67ca0a02e0c6059

  • SHA512

    df0e96ad98c7b5694907902c338f3d173806e6e1a41bbc0e3c1e5e387df1a67011f8d1f507ab52c87633f21ba7d7b466f80dfdd8b370cb07ec2729646667d83a

  • SSDEEP

    6144:TFhS9QH4pMojgpGGv1f93w9ost7jrWdl77dgJ7VHg4FTqjxeNBZqGB:vS9QH+Mo0GuK9ostDWdl75gHHrqABZqm

  Score

  10^/10

  darkcometfacebookevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2