Extracted

• • Target

    aa43280c8e662fe6bd3cf5d55c21fb70e89b47f856b25b4651b9aa961b649979

  • Size

    1.1MB

  • MD5

    690180390d587b9c770adde47892a7cc

  • SHA1

    19171bd17bfe41e08acfb2392df0114ac186cb96

  • SHA256

    aa43280c8e662fe6bd3cf5d55c21fb70e89b47f856b25b4651b9aa961b649979

  • SHA512

    d96032443d40b5e62bb77f7423e3a01413b452a0c295b58ecab478eb4f1448a70670d0e34241575b12bf148611984913a60cb5caa25e5589c7bf9096ee94d578

  • SSDEEP

    12288:l4ZK2mhAMJ/cPlS7+IiFtAR30PENSUrpWizowWefr3WhrsOEAe3/e3ydTMz:lF2O/GlSYFtuEP5UrGefrWNE32CJ

  Score

  10^/10

  darkcometallevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2