Extracted

• • Target
    a8f3f22dda294b02f410ca95116a23bf
  • Size 13.7MB
  • SHA256 64f87a54df363755339567ae103af89b64be18546b14b22b93610e0080c3793d
  • MD5 a8f3f22dda294b02f410ca95116a23bf
  • SHA1 413062e5f6a7ec6c23cb56fbb68c8984855e8a58
  • SHA512 a75fc1269444e2aff46a7901da89fd56b17120c56e4c7f89147a673e312dcc09366c9f16d3b4082f27a19a6f6aeed420c07112a5cbd04f8cd53d9792bb2ea711
  • SSDEEP 24576:4RmJkcoQricOIQxiZY1iaZzCvJtvH1MTZthrK5VifNCAM2CRJOon2b5Y/gGYaHH7:9JZoQrbTFZY1iaZzCvJtvHKTG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2