Extracted

• • Target

    ewas.exe

  • Size

    349KB

  • MD5

    a5bf2efdead82d9852a737a0ca4521b3

  • SHA1

    57343b85e7be6fa50062f88ee53eefabb8e9bdde

  • SHA256

    5ee259714e763e88a3579d399ea749b73758fb5e60f746533aece0bc656d51a2

  • SHA512

    6ebf213781c262084dcf586ece5917aa5df75139f2808fb710edddde9893d6fa919dbd66f891c96d6f006ecda235f1f2df0c045c4023c86882aed452b317431d

  • SSDEEP

    6144:hcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37gINuzp:hcW7KEZlPzCy37gJz

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1