Extracted

• • Target

    3365215f2c625fd51504e0e51d3aa5c2452b72089e0981dad1025569e868a889

  • Size

    3.1MB

  • MD5

    6b84b35b9b5f1f1b43c4499457adda4b

  • SHA1

    cabe5899b9bc1dfcc9e122692b3ec81bd405a92a

  • SHA256

    3365215f2c625fd51504e0e51d3aa5c2452b72089e0981dad1025569e868a889

  • SHA512

    153393e95357b0bde6f18f5fb92df38123c127b54c4f4eea6cfc76e7e6bbcf563a5cdb9dc8e798891dbb95ed22c3c9dea726f18452c77b246ff9bfd7220e9064

  • SSDEEP

    49152:Xr2KxuLaFzf5zmce0Z9jpVyd4fdBOdygokagOJFwtPLxx8MiGrlZ0iiQF5JxRQcs:b2AJFhmQZ9FVyd6+dytRJF2PyG3r3Q1

  Score

  10^/10

  darkcometvirpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2