Extracted

• • Target

    172af0ea71ebe1942681d48eba3418a5d5cd243dd9b4248407c3201146894c86

  • Size

    338KB

  • MD5

    27aed8242c89f5a513c097dcc36c5bef

  • SHA1

    9a53be98d594fabed2fc567e65b7b16d73b69300

  • SHA256

    172af0ea71ebe1942681d48eba3418a5d5cd243dd9b4248407c3201146894c86

  • SHA512

    8f81c85b4653096ccaca23a706527130eecd2a226c111db44138577efcd5446415fe5ebadf12e71361bd5e267f5436bd2f1dc4255e20e1fc55974f630e80b478

  • SSDEEP

    6144:wC4W+NSe7/mE5WAGb/msFw13ocRGQqrDsZOZ3ZpWoM7+aaTaaaHbiXJEdpC8bQ:w/W+cHEIAGb/msFwxocgQq3sZOZIbuq

  Score

  10^/10

  darkcometslaveevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • UPX dump on OEP (original entry point)

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2