Extracted

• • Target

    6ba71bb7f612544dc8093c9a8307705d0f163b15e09b6757b5528e7a9506c05f

  • Size

    998KB

  • MD5

    dcf14bb6e02becfd0b7f7b98a4ee3e4c

  • SHA1

    3c1a56a4a6d41ee34524605c6aa74a0f90a5dd86

  • SHA256

    6ba71bb7f612544dc8093c9a8307705d0f163b15e09b6757b5528e7a9506c05f

  • SHA512

    1d689acfb6960cc88fef07e87ddb50a728c48db0be85590a91c7e68ea981ef40d83e0693b4b0916b6e6234acbf2ef928ef427337cc8ecd2707f73db9cb9f0aa0

  • SSDEEP

    12288:7sr1USzDS/8WASf4J++TjRFF7OsGkyBZkLz8aKFyr14A9mI6f/iw92pl3HvepoCu:p4JjFmvO3RG9KXpVOHtgZt

  Score

  10^/10

  darkcometlovediscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2