Extracted

• • Target

    6cf2b3bc154cbcb50c6d065c6422880736a92d8ca80a553621da67488943717f

  • Size

    690KB

  • MD5

    f3e32c779b5a58213a677ac48de9fa81

  • SHA1

    5f702f105dea53d7de6b0c18ea68fa138d6cc850

  • SHA256

    6cf2b3bc154cbcb50c6d065c6422880736a92d8ca80a553621da67488943717f

  • SHA512

    42d86c6cb1681ac51d47ae2ad3cb642f12d4a5984d6d9ad182047cac4e3fbb40d46bf6689e659ae168782775d797e4b6f682de93f24385a6e70876fb4715908c

  • SSDEEP

    12288:G9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFqNp:iiBIGkbxqEcjsWiDxguehC2ST

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2