Extracted

• • Target

    90b8018ec5d9bb5858cc82eee023d1a925af8cf6ad665c76bb4b6353bf9c1217

  • Size

    603KB

  • MD5

    46943ae1c5f7da2f241e687160244e7e

  • SHA1

    6aa982f9625c562143ee160c923a5cf3346ad92d

  • SHA256

    90b8018ec5d9bb5858cc82eee023d1a925af8cf6ad665c76bb4b6353bf9c1217

  • SHA512

    726e2035ee385ee4e5f6d38bf98556367132fa133fa03d778552473b51ddaa130cd3fd328cc7f5f933206f7c6afe8451a13eb6ce33c09b9d0e333fb64dbbf416

  • SSDEEP

    12288:ISZFEdULkFFS5MO3ZVhw0jTC85FFoRGc5Zga+PBI:IyIFFJO3XfjTC8NUGeZga

  Score

  10^/10

  darkcometvictimevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2