Extracted

• • Target

    999edb0663eadfc252ed4223956c0ff20d976165e9c722eb6d4ff4e27f5eb605

  • Size

    1.3MB

  • MD5

    0ca617961ceb2d4af6d3236678929fa3

  • SHA1

    cd4f3061fe03338d12020d57ad30f916e410abc5

  • SHA256

    999edb0663eadfc252ed4223956c0ff20d976165e9c722eb6d4ff4e27f5eb605

  • SHA512

    bc22301ab9c50a0bc4fbb6777813d990d5d703b9baac6ecf1badfab82a81021e03af10bdb7955589f3c3b72ff0b6adc2dcf670cd9881e73fb254e92ed0d82f41

  • SSDEEP

    24576:f2O/GluCNRbvqYRYIdpbweMK5bBWQtMXC6kK7g6zwm4m53Sb2M:HwRbSYmIXMeMuMuMX7kK5kFm53SyM

  Score

  10^/10

  darkcometsteveevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2