Extracted

• • Target

    f708ba4649d77f880a8802709642fe5dc226aaa6be3a597aaabfd05b0ab3f377

  • Size

    1.3MB

  • MD5

    15d9a62c514046f4f05f8ee4e37f64ce

  • SHA1

    386d2cf3986f961e023f48ff1617f5c9b627ba98

  • SHA256

    f708ba4649d77f880a8802709642fe5dc226aaa6be3a597aaabfd05b0ab3f377

  • SHA512

    9280a47f581da7a9f665ddee4fdfff478e005543b11faf4e30a867ca0712496e8ea16a77b6fa39ef5c682bc765022b2355c07d7991f868ea2d5b3f294227179c

  • SSDEEP

    24576:nxmpirBc+MjsNXZaQIGrIftUJFU7faIhyrRBYonc0:gpyBc1INZaQIG0lUJiaIh

  Score

  10^/10

  darkcometvictimevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2