Extracted

• • Target

    0bc4dff8709c03d3249dffd1d5ef920ef9dda3ba0f6d2082a9a4ef852526671f

  • Size

    658KB

  • MD5

    41c97d1bac6fe5b92dfc8531c71a8920

  • SHA1

    ab23bf913a449d8275fc176a89d1751fc7683e0e

  • SHA256

    0bc4dff8709c03d3249dffd1d5ef920ef9dda3ba0f6d2082a9a4ef852526671f

  • SHA512

    18cea33da291132745cdeed9def70709b1c42c187cd4d1ca2d0be9f4706741b9e0b94e5016cbe9ada2fd8aa3e56b6d3c4cb4d5a8fb985c39759c1472f4664e33

  • SSDEEP

    12288:S9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFV:+iBIGkbxqEcjsWiDxguehC2Su

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2