Extracted

• • Target

    168d2bb706157fa1f41824f8ab3c8cac5468a846aafc1118b8ff183c2457bb61N

  • Size

    391KB

  • MD5

    43c5419faeff6243e80fb6858d21e370

  • SHA1

    ec04d2603326fcb80c37ec5cca7236d7d19c0d15

  • SHA256

    168d2bb706157fa1f41824f8ab3c8cac5468a846aafc1118b8ff183c2457bb61

  • SHA512

    509ec525d15589bbe38c61efdfce4e63639525e0dcfa8edac4bb1f38d938e2c5cb03caa9d7423bfe7b1abe37606c447587c722efd26aa688326fc9a9c4a069bb

  • SSDEEP

    6144:ARuMeWvIiqxLxDcKETsiR3vYFD6TtHxaefCPlh4XQCZ2bfjOAKdiFYuRWh:ieWvIfrDchsixvgEtHcj3vfbyL

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2