Extracted

• • Target

    59ca328456e4b599732fc4e01a03979a1275c509ccb976758946366e84cb5b30

  • Size

    785KB

  • MD5

    4695d2497f5b72d147ad34dc7b54140d

  • SHA1

    b46f3852b6a164d7de2f2e2a7a536470c4f344ae

  • SHA256

    59ca328456e4b599732fc4e01a03979a1275c509ccb976758946366e84cb5b30

  • SHA512

    9daf6e0726d232f3173a9b0ed3f28fccb3310e1e69c132ba5a611db420b15250fe622951ec773819442bbe8a6e17d422f3a9256ce4148d60b1966ae37e3280bd

  • SSDEEP

    12288:te/4ed1gLqODJXXn3n0kZJk+vZi3G0khHCpp1tlAhpxz:4/nsqOJXnkk/k2wW064dlY

  Score

  10^/10

  darkcometspypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2