Extracted

• • Target

    XPloit.zip

  • Size

    23.9MB

  • MD5

    df5931935ffe284ca5b40791607e7a4c

  • SHA1

    262399853d05ece01f740d1e820aa892b065b1bd

  • SHA256

    3d6bc3c0247c2b4f87282da002475ac068b5b6cac948743f697832a9a4a4c6de

  • SHA512

    38ac5f801f73714c840e16c8513b3c4f2d29815f042585a61c06830a76c1cae0e7e295241be686ae2d5f4bd19503ee9e69dadd611b1389d6ea9018553df785f7

  • SSDEEP

    393216:OH+kig1whmEJ+oUAgHRsP56jvR3vJ0RPaati4b8sVNSCoOYhkhalpMJpQl+25+:sB1w/J+oUANMj53vOxavKxoqhMgpw+

  Score

  10^/10

  darkcometsazandiscoverypersistenceprivilege_escalationpyinstallerratspywarestealertrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2