Extracted

• • Target

    75f5c1c5bfe419326168b3df63bedd56158847e0407a40c00d99b769261b9c01

  • Size

    380KB

  • MD5

    57423be12dc57e56586b4e15a3ca72b9

  • SHA1

    12f545e982d7352ac6c8323f9bcd5e12f8e70fe6

  • SHA256

    75f5c1c5bfe419326168b3df63bedd56158847e0407a40c00d99b769261b9c01

  • SHA512

    1c76e0126737c00b952f0c7c7b04e3ba1de8b71041a3b7419e051969604bf500f24c0dd49ec1cb6bc8be3b031a74172fe2e5ee53292d08f22b712ba1e0a5e846

  • SSDEEP

    6144:fkO3luofBhM7SRcGyQJnrJPXpunBKi7DVBITqGkNIjyQpBe:fkHopYWrJPXpuBKijYSlI

  Score

  10^/10

  darkcometoluwasakipersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2