Extracted

• • Target

    3d04e67b03b57c0010a3c6aac0b77a267190412042cfb73c62ed53532a9160f8

  • Size

    1015KB

  • MD5

    c99e3c046b196e1089652cb92b4acdd2

  • SHA1

    7ceafb7f7118307dfd1e304b2c017aaab4d538ec

  • SHA256

    3d04e67b03b57c0010a3c6aac0b77a267190412042cfb73c62ed53532a9160f8

  • SHA512

    8f3b5b4191a04a293d6f0b094261787594012870c55e43fe6d3f0d5e20438b76415611e08e7faf89ab765851498d65cfbb0bf6437098d1ec8bba765a713c6506

  • SSDEEP

    24576:/u+rKUm3C6xhvGhT72BFoSwKcid+anGwC0Nw6bPihjOGOiRVDC8X:WuQFQ/2/olKcioy5NwyPyOGv

  Score

  10^/10

  darkcometguest16persistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2