Extracted

• • Target

    5194028adbed199509326ded23b37ee34464892560d2c7c196d0dda8a3bda043.exe

  • Size

    698KB

  • MD5

    aa75ed1b108fa4129d827209c70a0e65

  • SHA1

    730af9657cb90becfe0c9a878f6d307b5bda1655

  • SHA256

    5194028adbed199509326ded23b37ee34464892560d2c7c196d0dda8a3bda043

  • SHA512

    8aaf0c9e562a6e44f4a0d669575d057a583613260af4bfa7a22aec23632855b87eb505e666415dc520bf2ffb42b96b3f46c6909ae44176156095e83064989a21

  • SSDEEP

    12288:uNAuo5DOxkhXzkJcX67+ET69NPA+qfnfaK3yXqkzIl+Me9Mp:uNrkhXzki6ql9mFfn53yXqEIl+4

  Score

  10^/10

  darkcomethfdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2