Extracted

• • Target

    7a8dad742401623928d542cdea3b01537a41d6d39b0dd25057e1d70fdf55c3e5

  • Size

    348KB

  • MD5

    8315a21cdfdc88c3b9b4fdaf2d4f2030

  • SHA1

    c92828e2d3dbaf2843088ce86b7296ca72d5d86f

  • SHA256

    7a8dad742401623928d542cdea3b01537a41d6d39b0dd25057e1d70fdf55c3e5

  • SHA512

    9db22c6a8fc369d5c9a401fa6ccb81667f84110283e6a403cc186f456526d4a7b28657ea2feb6e0bd4dc2539128c2b08bb60872106aca48fca8756f003a9ba3c

  • SSDEEP

    6144:mqLzGyzpKalLBQmByWWwf/vNsr9Rpef3jPrkIqn9dwbmIdsculFmQRMoZVK4Si:NphltQT29S9Rpe7Prk9PiFwFmQ9G4S

  Score

  10^/10

  darkcometkermootpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2