Extracted

• • Target

    9f95c22d51882e238da73706c58c9903b4f8543b8dbc549c8b01f9d3b4210165.exe

  • Size

    659KB

  • MD5

    21cb738e372351de0abf0f5bc532ab2c

  • SHA1

    af006c081c76f91866f377059db52576478aab82

  • SHA256

    9f95c22d51882e238da73706c58c9903b4f8543b8dbc549c8b01f9d3b4210165

  • SHA512

    308150556c89f262b74130c0548c134bc1e0ad4e29dd04500e297f53b15988fb3f79cda8a0dafeb225a8ceac1bec5ccfd57a88d02d16dbb82e29d5d703e4cde8

  • SSDEEP

    12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hy:aZ1xuVVjfFoynPaVBUR8f+kN10EBA

  Score

  10^/10

  darkcometsazanevasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2