Extracted

• • Target

    WinLockerBuilder2.exe

  • Size

    1.7MB

  • MD5

    410fe67a1b89105486140bb30a6b9ca9

  • SHA1

    f8d50097c608da77637977f64e7a48f3da7bc092

  • SHA256

    ff77277245800b3aa373bc1a9e789014ee50af2450133ae10c1569d84f32b2cf

  • SHA512

    94dd01181936b14b3b6d638e3aee8016d8674e0c3d5a1b48c4e8e71d6ac940aeb359eeb29fff4abb16585520d0720de0a56d83a866058e6741d9a052486383e5

  • SSDEEP

    24576:pGYwefQHQnJceBaVvlW1t39AJ4FsnAwtir2CESobryiGzozFg7c:pGYp5uvC9sAwtUH02c

  Score

  10^/10

  darkcometmodiloaderguest16aspackv2discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • ModiLoader Second Stage

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2