Extracted

• • Target

    69ab63c43dcc7832042f204315203140ad370a54b6b8aa1bad70b02628e26d57N

  • Size

    747KB

  • MD5

    3836b53342a37d161cb58d2d4474c4e0

  • SHA1

    83b4321ef1863c342960ad53387f3003e67c864b

  • SHA256

    69ab63c43dcc7832042f204315203140ad370a54b6b8aa1bad70b02628e26d57

  • SHA512

    b61d998fe141f673cef968b903245bc9e3774bdf6dfda80e81678fdf7e392b4af0c56ef24cfc75b98a967ecf3b9e36fb1660cf639b62d999a845d38b4c8233ef

  • SSDEEP

    12288:pk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+/qMd0QZs:C0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gz

  Score

  10^/10

  darkcometguest16discoveryevasionrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2