Extracted

• • Target

    458421dae4cac123f73a4d90a3b42f8423a8aa8018045371f94c4f059d3b918d

  • Size

    658KB

  • MD5

    81dd3e642183505a216cb92fee3a44a0

  • SHA1

    5df216d391f07aee61d8fc5a8eb23030e0dea06d

  • SHA256

    458421dae4cac123f73a4d90a3b42f8423a8aa8018045371f94c4f059d3b918d

  • SHA512

    d5c5b4fdf29d8f4fe40f4d1831468567d5d8f34b36775715534676a961362529468ae7456dc78997a00494b714341e91c51521a625290a3788dbac1edacb4b72

  • SSDEEP

    12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ht:qZ1xuVVjfFoynPaVBUR8f+kN10EBv

  Score

  10^/10

  darkcometguest16persistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2