Extracted

• • Target

    ba94334085c01266560cddd6718c357341e57a55aa3b06a4309c172c00138458

  • Size

    610KB

  • MD5

    0d1e64f6de675a3c85cf06bb42aba240

  • SHA1

    860a457e2bc0d52ed5e5fe2590150e98e2a05038

  • SHA256

    ba94334085c01266560cddd6718c357341e57a55aa3b06a4309c172c00138458

  • SHA512

    70e1c458bd8dd7c6fe6665642702aba27e76e5bd3da630c6e87aa77f83c5dff70f2b721108a59f4f723457e9655a9a8bcd1545f2f3e76fba46a92ff935e00e59

  • SSDEEP

    12288:HXH38FA7I8Cqm2zLMTtvk+aDdts2hYCBXNOWLjsehKcR3reSl8ZQG:3HMeqqm2zK4Bie1BXPNBKQG

  Score

  10^/10

  darkcometguest16_minpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2