Extracted

• • Target

    a7054916c930a731e93562e1ab235f2c47368822835caf4c783be41c0194ebd0

  • Size

    451KB

  • MD5

    5291b75212883d2592693fe4a62ffe30

  • SHA1

    d9f42b033b697b7bee193e04bb560373baab5bc0

  • SHA256

    a7054916c930a731e93562e1ab235f2c47368822835caf4c783be41c0194ebd0

  • SHA512

    689bca57c91945e9b8d000aa84873926b13752f39f31730d078c78213a1d6c996a8a1bb72e37b53731b3beaa0abecc84539a3118fc7fdfa4e7e5136c7128cfe6

  • SSDEEP

    12288:UTFKfKr4/AmWt+0NJ/Jj0FsUjRMOkfZ2DbVyCrh5Rn2l0+:oQft9u+0Nb0nlqZ2D5yCrhvnW0+

  Score

  10^/10

  darkcometslideshowpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2