Extracted

• • Target

    facebook.exe

  • Size

    350KB

  • MD5

    47c05a4b955100a7060167d4c7575ebe

  • SHA1

    bd834449be9f5b3b172293e0006afa489346f3e7

  • SHA256

    c0f7eee68ed62126c2626fbe95fd37276ea14e5c94b766a6464e292e317c5c48

  • SHA512

    2047cc37d80bfe6286a45b49912af59b32ca670a28dc9f6c3677a3e4f267c306d5022cb924f5fb6706fede6d1a6335f14a41b982c7ba98fe64ead034572a6995

  • SSDEEP

    6144:TD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ/S:Tl8E4w5huat7UovONzbXw

  Score

  10^/10

  darkcomethatabdiscoveryevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2