Extracted

• • Target

    1f74027f7792e95b1be337dc1a7d268a546c9b1feb2170347add8c3fb31c3783

  • Size

    713KB

  • MD5

    81d0c19275bf776c9a9c50fc8dd0db35

  • SHA1

    93495d5ffa9960bd1ff3298e3e454b6e96015ecc

  • SHA256

    1f74027f7792e95b1be337dc1a7d268a546c9b1feb2170347add8c3fb31c3783

  • SHA512

    0ff3a7b3e0fd92d37031fc16ee6834845aac9a581f631b2a7a0836581c9db96c05b95074cd09b19d8d89f04d920cbddbff4ae66b091e2c820d73e061dc159000

  • SSDEEP

    12288:RNfKLBRkfgWYGPKhyhcJrqFSWdNoKfeZ8EJa+Ez2WBtzM307xFD+4T/PcNXEsVuN:RtKLBRkYWzihjJGV7ffeZ8Ec91BtIx+/

  Score

  10^/10

  darkcometfrank-hackpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2