Extracted

Extracted

• • Target

    RNSM00308.7z

  • Size

    1.7MB

  • MD5

    110f2dbedc28666c7d8ccd4bba06d2b8

  • SHA1

    96cbc48fcab1450e18237dc77fd0e7d7e944a77d

  • SHA256

    51db189fed4125f4fb72ac9a078d1a95b9cb43be5c57259ad22a099c0b77d1a4

  • SHA512

    08ac80abb77925dbebc23b57ed4adf995a7a369f1c40d125ef9f73b7ced947343203510b0ad6b34dba20643ce3e13cbcbfbf9404f26b74766420a8b87d8f479c

  • SSDEEP

    49152:bcAdQUY0kuem8NGQM3gR6Wf26YbWNjCUt0p:bLBxTe7GQdXfb9Co4

  Score

  10^/10

  darkcometmodiloadernetwireusabotnetdefense_evasiondiscoverypersistenceratstealertrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • Modiloader family

    modiloader

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1