Extracted

• • Target

    ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63

  • Size

    693KB

  • MD5

    6de7cd0ab88ab2804c3406df023bb3a0

  • SHA1

    edf82e682f3eed25b22755ae52226131d9ccaf66

  • SHA256

    ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63

  • SHA512

    2ac5d42ed2ba3282881e2df8afc59043793baad6499eea5fc7dc3ce4e650e986d8833a7eee541b29c74794edaff7ce1ae4630be6c95303687f5714055d0d5368

  • SSDEEP

    12288:BZ8nw7Aaw+qphbSZmoTeBrp8pLKHxA/qnGIVuett6C63qGWKPMto3bybWBTBn/r:BZ8wEaL0oyBVSgJnGIVjGWFKbvn/r

  Score

  10^/10

  darkcomethackedevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2