Extracted

• • Target

    2886688a53e9c902cee72a3d97b0c4c333306ee8cfc8e5cc5d2275f623ef985d

  • Size

    988KB

  • MD5

    a49433ee96a2b6771026978cf9ba4958

  • SHA1

    dbe8ac5052ce8200d36d357853097b1584e53334

  • SHA256

    2886688a53e9c902cee72a3d97b0c4c333306ee8cfc8e5cc5d2275f623ef985d

  • SHA512

    8facf4671315e517a3a965bdf88ef307eeb656f12dd7ab2bb581d952a79edba6525a020b17b445e4790693cf472456836ee121a56b5ada093df9620bc4dab13c

  • SSDEEP

    24576:iCoUhRqpkZgDyv237jsWmubKXLIXCJ2NuJfY:iEhReNm8vfa8CMGfY

  Score

  10^/10

  darkcometgab002persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2