Extracted

• • Target

    71aea274979fc1275bacf5bcc1e7da6901171f9d7b695947fed085a553d2d994

  • Size

    1.0MB

  • MD5

    a03ed43ace6d29aaecf9a6c13bdc7b86

  • SHA1

    065ecf33db60b29a7bdd79c216e212a474ea34e5

  • SHA256

    71aea274979fc1275bacf5bcc1e7da6901171f9d7b695947fed085a553d2d994

  • SHA512

    7525501194eeeee98ab0a7e666c076392481692877780bad88a09fdfa5d4937c58faaa299885a1bf6b14d008fc3b9dcddd91ba8ec1747e4e33499ed3ed74cb0b

  • SSDEEP

    24576:6Ljvo3mJoJji1lybDnmHOu5vnp9k0soC+juQAJcC:KjvoR9iDU0t5vIKju1c

  Score

  10^/10

  darkcometguest16evasionpersistenceratspywarestealertrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2