Extracted

• • Target

    54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea

  • Size

    271KB

  • MD5

    c239c75c787b2181d8dc1a0882b4a159

  • SHA1

    a0e573b00493677797969c52e3c30e3d145e0eae

  • SHA256

    54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea

  • SHA512

    ab4aede8fb02bf481336004c6ce90806852bb39de431fd4d028ee7c048390beab680debb851eec36d40c71f971d41370ed1f3b2fa3782cae7489d9b8a2a7dcc8

  • SSDEEP

    6144:XgfVPno0A98mfqyFD2ibY6aRwqlg1NpHcCxxuTklqttnN4l:XgfBo0iqyFD2ijs2B9cbbal

  Score

  10^/10

  darkcometguest16persistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2