Extracted

Extracted

• • Target

    RetroHack.exe

  • Size

    650KB

  • MD5

    f04f2b2f5d5a158dc13cc31454b49187

  • SHA1

    9f974f15a18c3bffac7d23ff7b86c74efafbe1db

  • SHA256

    19570160318b305d9700803dcafe231ad917fd78fce7c06a7a97e0b800ff295a

  • SHA512

    1a579d6304f078ec849bbb6d3d0aaf347873e7ad7fa1c0e2422b2444d15fedc26b927bb0da727d59415c2662da3195ef63e9918b982ba5cf36856437a9b28ea2

  • SSDEEP

    12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+R:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gc

  Score

  10^/10

  darkcometlatentbotguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2