Extracted

• • Target

    d9e81eebda7fdfa6bd3b2595f935a4da328ca59e0b33ebf5a9df3043af9df0e0N.exe

  • Size

    690KB

  • MD5

    e0252fb44429d388a10f814121992b30

  • SHA1

    3bbe00564cace10ec07a242731e52530b5d43a03

  • SHA256

    d9e81eebda7fdfa6bd3b2595f935a4da328ca59e0b33ebf5a9df3043af9df0e0

  • SHA512

    291e4c65d1f84a6617ad6a5c8ab3a75fac6d8da0575f172543d696ff8734b96031644de15c0a87331a3a5a456a678cdd0ecb9c530450ebe5f246f1364c0782ae

  • SSDEEP

    12288:J9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hRd:TZ1xuVVjfFoynPaVBUR8f+kN10EBB

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2