Extracted

• • Target

    9743485fb879f786a975418b01003d39

  • Size

    456KB

  • MD5

    9743485fb879f786a975418b01003d39

  • SHA1

    b3a41b2c1f82437f5bef0109fa4e884b03ade295

  • SHA256

    3ab783b17d6fdd4f8a53053c46662b55c2625c41ff6fa40fcb06b5f90d15ffb1

  • SHA512

    9a0fe2fbbeb352a8718b097e8b680f5e5f751cd4027190629d99c8da3df3f44b0864e8739a35a613e5f609aa943fed569e45332f7c67503011e2124c5cd34234

  • SSDEEP

    12288:/aPSx9BQ26xD6CPqbohjayHxtgFVdNBHqFa6G:iPSx7Qx5vPJZRtgFV1Z6

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2