Extracted

• • Target

    b96697777782b12c83a6791e7ab2e4bddc8afaf784716b3b7dac84f710f521da

  • Size

    585KB

  • MD5

    733284fd88c1db268eb8d011b4ab155a

  • SHA1

    7905d4a7cdcf06ba4fac0cda840d409e90e4325f

  • SHA256

    b96697777782b12c83a6791e7ab2e4bddc8afaf784716b3b7dac84f710f521da

  • SHA512

    4a4fbf796be223c1b3b7f6774cf2917f5787a3c73c3b32c7b12307f54bbcb89c8d3d4607d34d1b87e2df95839304fc92b28a169f5d8a33ca41cfc6896322e118

  • SSDEEP

    12288:Si0+UP5VGcS2/cpcxLES/DFpCi1X3JKnNvwFBmz0QRcxA:zW5SnOufi/FBiD6S

  Score

  10^/10

  darkcometguest16evasionrattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2