Extracted

• • Target

    1ede41d6a04c69518f45c74c8fdb874b98f076b7de89d1e9c830949915561b23

  • Size

    1.3MB

  • MD5

    8973a50805bd65665b7a391442638166

  • SHA1

    f47250ce50bb3efa491de4cef210e114be24a217

  • SHA256

    1ede41d6a04c69518f45c74c8fdb874b98f076b7de89d1e9c830949915561b23

  • SHA512

    67f324263c8a38983fe17847112d44e180c9ab5a00e5c855fe5c991b0921b7323bcdcfa3df67fbce0be39b5b0398c0bfc5cf9931297e69e80f540a970afe8ecd

  • SSDEEP

    24576:v2O/GlcvbhyBkvNcTMRLnviGi/2P3CrnNXX2H8kqTgYt0vG9YoQ:lhcnM5nabW3CrNXGq8NvG9YoQ

  Score

  10^/10

  darkcometbildeevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2