Extracted

• • Target

    22688d00a7f7a5b417510b1678a294d04344874473ef8516757ee97c189a9822

  • Size

    931KB

  • MD5

    0c6822b399ad20c163522393db577547

  • SHA1

    51b2579d90e7028723d6e6c7249e49b12e0d491b

  • SHA256

    22688d00a7f7a5b417510b1678a294d04344874473ef8516757ee97c189a9822

  • SHA512

    22137c4ae81e46c4edc8dfeb5b7038aed0d449b03a3314809440af500dab66f42d7954d081343aceb7fb14a8e6f3e55f45617d5c13c36f5867eacc4dfcd0a722

  • SSDEEP

    24576:DZ1xuVVjfFoynPaVBUR8f+kN10EB1hoM/kp7wZ4:1QDgok30ehAp

  Score

  10^/10

  darkcometpointblankevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2