Extracted

• • Target

    e3078669c4480cfcb40450ce0aa9e731dc32f7290b1e34081b20d29c0aca54fc

  • Size

    1.8MB

  • MD5

    fb3a65252966c1987ad924dda4fda3ba

  • SHA1

    e055d2a6d84cec7aee7dfbc14630ab6ff23db358

  • SHA256

    e3078669c4480cfcb40450ce0aa9e731dc32f7290b1e34081b20d29c0aca54fc

  • SHA512

    2ff2d960d904ce0673e038812490f4bda76d85b217af4429d73ed2266d3c59a97c6380e50bf3b9260695374d0e324bfa53c24802862f65fd011c68a193907159

  • SSDEEP

    49152:bkwkn9IMHeatQcbdpKncQYT2KfhzwtaPCS:IdnVVBMcpT1J/PC

  Score

  10^/10

  darkcometguest16persistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2