Extracted

• • Target

    easyMalicious1845a1255c8d.exe

  • Size

    948KB

  • MD5

    81aa0004ab6395cc670810ec1912133a

  • SHA1

    94a2f9f9f9e050c1fed207ddd51c2c3dee15b80e

  • SHA256

    c1990fc60695c907817670cb510764eab966c0581ce825820999d42e1d4a930b

  • SHA512

    098e82d9269de8a31048bda1b5e92bfdbe059f3d8b910eb66a1574f03f9ffe035dcd3e4e93ce2c9a11bf574093183a3845157f3e767d9dd8db710fcebfe94c68

  • SSDEEP

    24576:GZ1xuVVjfFoynPaVBUR8f+kN10EBgu+DK7L:WQDgok30hu+IL

  Score

  10^/10

  darkcometmetin2persistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2