Extracted

• • Target

    f29e972d796a5fab992c5ae973ba1cdd7be5cd8840aaebfd4252725abadbd3d8

  • Size

    1.5MB

  • MD5

    90ca009f81efa96a4fdb9c92308d1160

  • SHA1

    4d4173207b2f7512b1be4464cabb0df1e32d23a2

  • SHA256

    f29e972d796a5fab992c5ae973ba1cdd7be5cd8840aaebfd4252725abadbd3d8

  • SHA512

    04405a292ed33dd8320441e7feaa362f954d258d55ae5295c84457d33ccf1179b51a93855eafc381a53b2a53381676d98ca071be09abf88b212a94b7090e2bc5

  • SSDEEP

    24576:Rtb20pkaCqT5TBWgNQ7aaJsFgAMrirDfQxNel83lB63P6A:iVg5tQ7aae+CfQxNEclc5

  Score

  10^/10

  darkcometh@ck3dpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2