Extracted

• • Target

    9054fd07eff52349a740bc6202cc6957496d1a70cbe5cb006b40d72db0ba847a

  • Size

    1.8MB

  • MD5

    7634e21993a82b8bf1906df9c83dcfb6

  • SHA1

    3bff833bf7d77465194ed7759c455861d5e9ee75

  • SHA256

    9054fd07eff52349a740bc6202cc6957496d1a70cbe5cb006b40d72db0ba847a

  • SHA512

    b86a09b32aac425e601783fe38c45df2afe2c2564683e5bffbe3d051374260de675b6ac38ede9b469de511cc19b7e08425ebd7571c4a43ce400f058fb1663e89

  • SSDEEP

    24576:ZPuNKEpMtcGnPblbg2CMumABe1vUmeuVF4pNq2cXsuzE6yRpxdOe0siOEC:FE9GzWk8epJeOFu01jyLDOediOx

  Score

  10^/10

  darkcometbmxdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2