Extracted

• • Target

    f1d61cbcda0b9784bb33b45d96f98b3e027a6b5cfe89552e47d15038dedff23d

  • Size

    1.0MB

  • MD5

    766a48198b5f332debc69cf1e0e87bbf

  • SHA1

    d805b0ee573788f94375d87b2d8af5a3f56e6ef4

  • SHA256

    f1d61cbcda0b9784bb33b45d96f98b3e027a6b5cfe89552e47d15038dedff23d

  • SHA512

    5ae3a2e7af67b20b16a9f4f077449074b3d63ae24108027bc2bded3eecc4cebb1f225ef0c96dca24f736c51867f96878bb18c8f08d4bb6b0729b75724102c749

  • SSDEEP

    24576:MKiRzC0UAaNSl3Jx5/16qCTF6RQHDO1AZ8S:NiRnMSp5N6PTfi1AZ8S

  Score

  10^/10

  darkcometr77guest16evasionpersistenceratrootkittrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • r77

    r77 is an open-source, userland rootkit.

    rootkitr77

  • r77 rootkit payload

    Detects the payload of the r77 rootkit.

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2