Extracted

• • Target

    8606debb563ac66cda022f4163339ecbcba4ef845d470cda68149fa2a88a05ffN

  • Size

    3.3MB

  • MD5

    87e724f9d94f5aa8007641cd9f59cc00

  • SHA1

    521ab3c3971449d55064acace1b397fb96cf334d

  • SHA256

    8606debb563ac66cda022f4163339ecbcba4ef845d470cda68149fa2a88a05ff

  • SHA512

    b992161dddfebe54f26780262ff4ae7334bbba4585a05325828a35e612eb67ba035139fdf37d6dea26e72a7de73749b161aca57a48e53052433e5ec08f5e3aab

  • SSDEEP

    98304:GQU/lHt2VHrDoIoH9a2qLURFiROdlOvU37EG:GQwQVHv8HXKR6AvU3b

  Score

  10^/10

  darkcometdiscoveryevasionpersistencerattrojankayýtt

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2