Extracted

• • Target

    b4d47dffea5885e4a5a9b7d329949d2523fa6e528d24333f8ef719bbe5d71964

  • Size

    814KB

  • MD5

    74230b48a3527617281d77d88a876591

  • SHA1

    eb36e4e7a0a4a18cafe4405988542f3742aee86e

  • SHA256

    b4d47dffea5885e4a5a9b7d329949d2523fa6e528d24333f8ef719bbe5d71964

  • SHA512

    b3275c8f4d4069f81ac5467d641ef9fc7b36de8fcdfd97d2e47c22a3c894a494dc143cb4d5a4da85434f9d38a636ea2b31151c06e7d8f32f582fef0497dc9aec

  • SSDEEP

    12288:LifsksSl+IUfUGkk0lzSqfJhUIgWc4S5m48kA+WWgNhUO2NncLBwvgRTGJIKW3/u:eHZUZNaqWHgRRORBwvgRuS/81L

  Score

  10^/10

  darkcometmodiloaderserverpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • ModiLoader Second Stage

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2