Extracted

• • Target

    d1154b48aca1e4a5596d0094e1eab310_NeikiAnalytics.exe

  • Size

    658KB

  • MD5

    d1154b48aca1e4a5596d0094e1eab310

  • SHA1

    d87f2eb1455b25eb2e5bc0d5c0db40c17aa2673b

  • SHA256

    be7656e2b1231f4d605532b23aaaeb8671cb5365e915bce6b34cb07e8d473065

  • SHA512

    91538539864ebb17bb499c06ac0cb4dc15e983736019211767a7b9338d8d5fcff9cdd23abb223e661bd677ad3c8d6bfff03b270f4a17ad90fac51c24d39893e5

  • SSDEEP

    12288:69HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZK3/X:2iBIGkbxqEcjsWiDxguehC2+

  Score

  10^/10

  darkcometguest16evasionpersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2