Extracted

• • Target

    bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a

  • Size

    1.7MB

  • MD5

    af2d7fb9fbf0fb5ccb3736a50595e1c2

  • SHA1

    40a547cf32cf77b993963a7833a2b9981ef82acd

  • SHA256

    bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a

  • SHA512

    b06be7a07a521542da36a773c1b7f565938147928ed515182de1922bb1a60333a25118219eeeb7a113473dce028d115b15445d4087e11bae42b4d6736f5396ee

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iadvKmxTBNWyrAr7Kl3ysb375I8AS0fhGT48qlc:mJZoQrbTFZY1iaJ/Rro7Kl3ysK8A6X

  Score

  10^/10

  darkcometvecxedevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2