Extracted

Extracted

• • Target

    heck.zip

  • Size

    819KB

  • MD5

    dd652a718bced9e86425da269004c5c4

  • SHA1

    d63f4d173ed9c6b2689f5a2db978f6e9fae11ebb

  • SHA256

    e5c54e8c08be3b4e41d08b24ebcf8f99a37f587c11303dfd1a4672bb5eb3d4cc

  • SHA512

    63da000f8065a5931d20dcb64b00f411188c6ddb09e7a708d88b240543f24fc169077b2500835496f57f56579ff71a94188c3f8c0d23e841c1b5609bc69d5355

  • SSDEEP

    12288:dn+xqAHK8V0U/EYCa7P5W3RwMe4QGOmoZETqowpHuqZCFtnW1Xk3zsnNoRnXvC3H:1gbyU/EYnw32V4QFZETqo4lu0kCOqPx

  Score

  10^/10

  darkcomethacklenendiscoveryevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1