Extracted

• • Target

    c2d70852c9ea40063f86b128b28cd62b16612ee6edd9bf254ae27d0ee67663e4N.exe

  • Size

    658KB

  • MD5

    9cc514035fa92be0dbc399cdf3871180

  • SHA1

    f5d1e39f30a690039ea2cc5eff294ca05a4849f2

  • SHA256

    c2d70852c9ea40063f86b128b28cd62b16612ee6edd9bf254ae27d0ee67663e4

  • SHA512

    610c665b713bb112640051bafd0ed7bdab29d9c365c46a7723fbb7231d1f8678972dcd238b0a610b456cee8b41eefd6bb57e366fbce874a05bb2f8eff3c0d088

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hK:KZ1xuVVjfFoynPaVBUR8f+kN10EBo

  Score

  10^/10

  darkcometniggerdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2