Extracted

• • Target

    de5f09e0a1c8231b06860149cb8701b692925b45c51437812bcbad4d3171369f

  • Size

    659KB

  • MD5

    88a08e03244386ad4044b52d05863cf8

  • SHA1

    094aacac64a069e3fae53c7b866041f81f5da951

  • SHA256

    de5f09e0a1c8231b06860149cb8701b692925b45c51437812bcbad4d3171369f

  • SHA512

    0e0c62044c473ab4407c88613056fec379cca114cab3dcd0926d0aee5cf69ccaa340ec0255261a017a2afb7d8ff0b0cdd854e16f399142e16b40160234f33d74

  • SSDEEP

    12288:G9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hq:iZ1xuVVjfFoynPaVBUR8f+kN10EBA

  Score

  10^/10

  darkcometguest-2evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2