Extracted

• • Target

    Bloxstrapv281.exe

  • Size

    11.9MB

  • MD5

    0be784b86944b7a9bf441f7a162c5063

  • SHA1

    c9c4b60ceecbecd97ccfbb32a5ace6792b13b87e

  • SHA256

    554ba8585577dce1573b9b1a43607fed63d70f8cd38e9ab7bf7b8df219453ad1

  • SHA512

    f4381fc9164629e93c0e5f459b99831c6b1825640104081a0370136e3d539fbc9bedab89b459b4583aec75ed5352abafbd05fbcdfc8d64819b8f9e2abe4b2086

  • SSDEEP

    98304:o1qZ+pv3Tscod5DFasb/r5vGWD3EOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlGK:o1qZ+pLscVsb/r5vGlObAbN0t

  Score

  10^/10

  darkcometguest16discoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2