Extracted

• • Target

    salam.zip

  • Size

    11.9MB

  • MD5

    87973080c4af4599633d7f9f05316762

  • SHA1

    3240fa549d25a32b5f0368073ab80d5e97672cbc

  • SHA256

    fb9f876bc4e91df2cf44027af5897da38f646f25e1652857674c9a69b2beb04e

  • SHA512

    a3ba15cbe1020a24d384acb601f22cb8b0134bdab3bef3d875c1d90343b906a6d4eb92b725a0d0bbd016cb474ccd091b48cc5c2d5abec43d6c8385fbc7e62ccc

  • SSDEEP

    196608:zTDdNelq9wnJrOo5gPOaeXNH3flTrLl+DpZ5pfju/w9kGO6NmFkch2vd7NiP+9/h:zv6q+n1D5+OaedPlTF+VZ5pLuY9ko8CJ

  Score

  10^/10

  darkcometmal-trackdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2