Extracted

• • Target

    443051914672ecbcdbddf897e2db78f90008ad49e9d6073af5978f2f8038a957

  • Size

    755KB

  • MD5

    4331bdb8c7fec28e046f758e1446b2d9

  • SHA1

    96776356f513d9a29ebf499c71d77cfdd0cae3fa

  • SHA256

    443051914672ecbcdbddf897e2db78f90008ad49e9d6073af5978f2f8038a957

  • SHA512

    39675a8dde4078d32f69125e8a8b87d562c24fc8189e993c6b892b9d9c8bf80b57bba5f9f6d54aa41e794069d98b274563adff8f03b9119c8f543eb8f41c2515

  • SSDEEP

    12288:hcvpGGNuioj9UHpnsfTBlaJKJYKbrIFuGW6nEWRyLE2Rx:KvECU9UHpnsfdda+1GW6zRyIE

  Score

  10^/10

  darkcometneshtaguest16evasionpersistenceratspywarestealertrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Detect Neshta payload

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2