Extracted

• • Target

    f018c0d14c1b9ef5421920538e3e0efe33c91fa3bcd7b56fde9252bf0f5b04ef

  • Size

    708KB

  • MD5

    4cc6c28d2beacff83e9f12bfc0120565

  • SHA1

    a1c8e595a6d1ac1043fe50e93d87e883d54a3fdf

  • SHA256

    f018c0d14c1b9ef5421920538e3e0efe33c91fa3bcd7b56fde9252bf0f5b04ef

  • SHA512

    bd8aa7e44c1e780d41af98970073c39fd399145e9cd55d05f69511aa4dcdc6d964844a128c8ea38aab0f9804466c796fec3907186b83cbac68567c035e070fc9

  • SSDEEP

    12288:eIh4EY1awKtBnrtw8bzRpyMObDkeFsB7pyCEbSTiTwRkfy9h4ORA/KjWHZ1dAx9u:eFoXBnpw8bzRhObDkvEbSDKC2UmKaHZd

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2