Extracted

• • Target

    Lucky Proxy.exe

  • Size

    10.7MB

  • MD5

    f9f683c1fafc61bcccc9a44bef1f2867

  • SHA1

    464183bbe171e5b07921d293f2692c517353f6e4

  • SHA256

    9eca9396e9230e5d10850f535d8c08f571e73b76794f45c12bdca8a80446314d

  • SHA512

    ca6481f8b1d0d2917368f3178256c2825a4de13b5d9baa720e7fa2aa3fd214b13881cb2457af1abe75345348842ad8896e8f1962d672ffb6cddf008dcd940279

  • SSDEEP

    98304:FQU/ui53ANXrPQU/8rJPPGlTrMdhSzVozBjVTcZOOSaHE6+KN51dE27Kfz7ns9z:FQPi5GQ7PuqShYBDRak6+AK2OfA

  Score

  10^/10

  darkcometeternityguest16persistenceratstealertrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Detects Eternity stealer

    stealer

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2