Extracted

• • Target

    706846d99683044c8f5fbea2897c007a55c4cbdba64f76a02bfe80ce9fde277dN.exe

  • Size

    304KB

  • MD5

    342bda490672d77622a6917ccecdab20

  • SHA1

    3bb653874418bb2a3666f2ca39710d97b1bfa871

  • SHA256

    706846d99683044c8f5fbea2897c007a55c4cbdba64f76a02bfe80ce9fde277d

  • SHA512

    a5d0ab425b723165072ebcfbd65cd05e464a83774dd24a30a10a10654d068006bd06dfc92f1b88010ebd05c4f629a43b18b5331669a1ee9fc8d5f66572dfbe7b

  • SSDEEP

    6144:X2T/3If9vSuNT6woPu7pWil15P0Wrep5h05X/CpNWpyJoNCzh:XQ3ICaEil16Cs5u1974V

  Score

  10^/10

  darkcometguest16_mindiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2