Extracted

• • Target

    547b5f8fa22536e6ef421540f6f2308e02e09f841e17676dd16db35f3a01853c

  • Size

    1.3MB

  • MD5

    e30c9b8c07eb6bb88f16c6084879391d

  • SHA1

    09cbc8d0fc7024bc1d413537b2e56265809a8f45

  • SHA256

    547b5f8fa22536e6ef421540f6f2308e02e09f841e17676dd16db35f3a01853c

  • SHA512

    47bdc5c82e5886d57bc8e67307c7e6a21ff47e111dd0f04bb85aafb5d672a5b243f19eae23658e70fc3279cffb89468114015e4b44d21b3001dfb1e2118718e4

  • SSDEEP

    12288:xiemWOmVwMiT1GHu8btht2NziYTSDvcFlRShkyObS4:seOmVwMiToHuAt6ziY6GlRSAO

  Score

  10^/10

  darkcometmodiloaderroutediscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • Modiloader family

    modiloader

  • ModiLoader Second Stage

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2