Extracted

• • Target

    96703bbff93d67c95bc9c978c0bbacc1a6b1d8965664bb57d5b78fadb70fb13d

  • Size

    1.0MB

  • MD5

    4964cde7c7ea5e5145c6caadb60415a7

  • SHA1

    93ead8756eecdf176ac08c42222dc4ffe709319b

  • SHA256

    96703bbff93d67c95bc9c978c0bbacc1a6b1d8965664bb57d5b78fadb70fb13d

  • SHA512

    0acff959c10c944613e02fa379640511abe85c6c03352e190469ee33418d1a4a4bbe98d0c413fa5d9d441c5e3477c700e3c1f99ee85469955ea4941fff164003

  • SSDEEP

    24576:3tJn4Jyr6yDZu0+RKlDsxF7a2fiGAJ2iY89/+mTQU:9d806yE0+EQ7JfiG+z9/+aQ

  Score

  10^/10

  darkcomettarzanpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2