Extracted

• • Target

    4088ee44a88a3c6b3d8fe3809f03878c19ea5cc17645689c36704099f00f2e9a

  • Size

    1.4MB

  • MD5

    ed87dec989504b9b2783e6050ad9f7fa

  • SHA1

    1447e1b6b3308f49d52f8093ca8e66f4b43e9549

  • SHA256

    4088ee44a88a3c6b3d8fe3809f03878c19ea5cc17645689c36704099f00f2e9a

  • SHA512

    57a01514d9344a48919b2812580c1d7eef136870027a7028fd82410d886fe2d24c49edb8e1b7d2be0c51c8de517c0456e65ec0191fa6616486214740a3e8d1bf

  • SSDEEP

    24576:C4lavt0LkLL9IMixoEgeaM4ag95X8DfmoumWCd/9v0vFmlYCq9MmCS:1kwkn9IMHearag95q+oDWCd/98vM1aP3

  Score

  10^/10

  darkcomettestingevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2