Extracted

• • Target

    c6ef17c3bfa0782631efaa9ac9583001af5c59ce3eb8dcce447cba0a800ecd0d

  • Size

    417KB

  • MD5

    1be902072d94a1e0d22d394c8414d757

  • SHA1

    27c7f65fc7a19d438937fe812e32557338306343

  • SHA256

    c6ef17c3bfa0782631efaa9ac9583001af5c59ce3eb8dcce447cba0a800ecd0d

  • SHA512

    b088869a8d2625d3c64a63bcc9493b65b0cc8ce71f9830b5dfcce1c19cb9acae97efee34fd4854e55a1288f430a497efb89467f0510a1c97e2a25de97c747fc9

  • SSDEEP

    6144:lRA4+az0ZWOh5dj8j21f2p3CMSnltlDM/azp6059JEnR7clmvZnPKeFd4MK5:P+O5OPpNsp7cnF00TG3v9CMW

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2