Extracted

• • Target

    2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2

  • Size

    452KB

  • MD5

    7de9787876d0ecb71648f25bd1e5fc51

  • SHA1

    2bc2b1a2977b64eb22d069941a45abfe04d44622

  • SHA256

    2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2

  • SHA512

    347a214a9cfbbd799e1a0f11568959884909d9dbd9bafd8302859af9ab7c5a2bb5328a1f28260b1839f1dd6952197e02bd75cd5a09dec4026181857d8b2b4bc9

  • SSDEEP

    12288:6M5tnmfeuL8U3yoWwYLtfCgaNiAY8lIkd+:6M5p2nL8A8wYLgFNfj

  Score

  10^/10

  darkcometsureteypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2