Extracted

• • Target

    6df11d59c1f9ecf9f5e1dc43d0859555f78e0179c475b5d70811dc8d22326b77

  • Size

    1.4MB

  • MD5

    2bcaee20d4fcb2901a9d826d3ebb2bf7

  • SHA1

    613d14de92d120a87f9dbf08750d63fa94d1036c

  • SHA256

    6df11d59c1f9ecf9f5e1dc43d0859555f78e0179c475b5d70811dc8d22326b77

  • SHA512

    355759f8df2db60c2a319028572d56228410a8efdf32d132148e3a7d2a3f6b67352f6f2a52d5399c54bde0b1ef4417fd193bcd09d547de2401fcbae8878247e5

  • SSDEEP

    24576:o4lavt0LkLL9IMixoEgea9x4Gm2wqlNi83qlsV4H0c91Ys9sRCfhCq9MmCS:/kwkn9IMHea9GGmqi8ibH0cYbhaPCS

  Score

  10^/10

  darkcometguest16persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2