Extracted

• • Target

    56262d9f84c49c9689abe6f697e16453af70f6c58447d7997afd100703abafb9

  • Size

    283KB

  • MD5

    8c859f679398094cd891a97081ab13e2

  • SHA1

    528e86428f7a0b885af3de45a38693bb515155de

  • SHA256

    56262d9f84c49c9689abe6f697e16453af70f6c58447d7997afd100703abafb9

  • SHA512

    4dd2b9d59d56bccc0a73897a7c1107d2c77970c2431a00de6f18f6ce9b6bebe5b14676ac1e0c594f94c21f7415694c646bf3a0bc695209242dacd0b5a1d522f9

  • SSDEEP

    6144:6cNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0P12:6cWkbgTYWnYnt/IDYhP12

  Score

  10^/10

  darkcomethackedevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Executes dropped EXE

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2