Extracted

• • Target

    53c30ab677a3c5538043afa46faadecce838a183889ffdd17655676ef7e1176f

  • Size

    1.5MB

  • MD5

    e3db605b6b773ae7ed7fe8596abae583

  • SHA1

    2b573adfe3e3a2edc68936a3e864d7a9a909f12d

  • SHA256

    53c30ab677a3c5538043afa46faadecce838a183889ffdd17655676ef7e1176f

  • SHA512

    a5b139462b64e1196045000efe64ad553d8ee3204b5da3f9b3e0df77bcec3b6253b5d169331338f009c8213023443453bb1a5f18417c47e5e179378a7bd2900b

  • SSDEEP

    24576:/RmJkcoQricOIQxiZY1iaE/IyPoXBInUZQEAb+owaADl3N4d3D40Vf7:UJZoQrbTFZY1iaeIJX+UZZE+fl36dMkT

  Score

  10^/10

  darkcometguest16_minpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2