Extracted

Extracted

• • Target

    29df8c87af90d416babb87ade425c500_NeikiAnalytics

  • Size

    645KB

  • MD5

    29df8c87af90d416babb87ade425c500

  • SHA1

    28b34f9f22cce993f9fb4afb01c68d2ddce70a72

  • SHA256

    892b68f736e2cf9fb804607dad54e6e4ea8e68718fff55be8564dc4a45b39c9f

  • SHA512

    66b6d1a1fe9b1b94e2d1ce4f5f252bc0db553b59d3d55e47eb395a8364b4072623b8b2225b0f6d584a8d96b422c3d53a9bd310e5089bf6eef2bbe6a64bea6ca7

  • SSDEEP

    12288:Jz3CC5MJncGC3ZE+Nf0YhTXotLPOjO15rMMHreBG/W8BTN7FyXYsIHZM:JDX52cGCpE++YoPjHrMr2BTjIYF5M

  Score

  10^/10

  darkcometlatentbotfresh++victimpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2