Extracted

• • Target

    f1068b56389a0b3344a31d0e4590c760a682988e5ad01df53fa5648ed883d506

  • Size

    690KB

  • MD5

    11ae0618b7f1caee88ab38a1b8d32d91

  • SHA1

    24f102feb4c1283c73005afd784787df968e40a9

  • SHA256

    f1068b56389a0b3344a31d0e4590c760a682988e5ad01df53fa5648ed883d506

  • SHA512

    7220b68b68d8dcba0d2f0f234c3fae21298648b4a37ccb1735a9049eaad4b8d78407e1be0afced1389040a97d469916a1db18cdadae11cb7244e84ccb59cb9f3

  • SSDEEP

    12288:d9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5+/hKf:3Z1xuVVjfFoynPaVBUR8f+kN10El+

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2