Extracted

• • Target

    976299004249831506c9addef3cb6ae2

  • Size

    1.1MB

  • MD5

    976299004249831506c9addef3cb6ae2

  • SHA1

    28d0750d67a88c8bde6ce763ac8c77fffeceebfd

  • SHA256

    42fe2ee15d9d75d1dc3c456c3240dda7f875c6f2a4f7acbd607655d488032b1c

  • SHA512

    d5ac16e10e5481f21a7a2b2d9bf94ca0d3a963c17209ed6164ccfd539f655f39dd4b33f1c1093921173f1670e197903a5db94728f02b0787af4d3ce7d573bd27

  • SSDEEP

    12288:VlyOEIzifoEqqx2XcLnsYRg87cvCPAq3djaCRvUXC9KykRvWIb0aeeXXR+oGElk+:cAXOsH6raCSXC9ZQb0beRbGFz+8hs

  Score

  10^/10

  darkcomettrojan_siriopersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2