Extracted

Extracted

• • Target

    A1DB2JVWGG.CNT.exe

  • Size

    2.1MB

  • MD5

    a7817732eded62797b0c5e9da109edd7

  • SHA1

    e7e868e8a529cdd6bd32b4fa3711eff0c9029dbb

  • SHA256

    95969e3e0c1793e6177d5c5d20c9a667c9f28bb64907ad489682c41668efc29d

  • SHA512

    3664953e0e5c601e8d8123c0b9f3f43d727bf6f48f81a93fed051d6f0d275728ceda92ecef201e4cdceac29c17ce66b46820a43a6dac9fd4b77b6d54f226db01

  • SSDEEP

    24576:tA74/4qimDN0nixgBQcZ+WtGsK0i+CqBRCJcbpaa4S7qeL7pjhlyIy6Vs6wGpYUa:tA74/t6FQcZ+WRs+BRL4ShjTyIF

  Score

  10^/10

  darkcometnanocorejune 2023evasionkeyloggerpersistenceratspywarestealertrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Windows security bypass

    evasiontrojan

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2