Extracted

• • Target

    Comet.exe.bin

  • Size

    8.6MB

  • MD5

    1f5d19397b48172aba35885f39e318fa

  • SHA1

    df77020bffc62f386b5ce0ad0cde3d8f8b704b93

  • SHA256

    dd780875686be33910002f91aaeb8f8ec70a2f3972c41c707a59ef18cd900e74

  • SHA512

    4ccec7c602582d467a63e8f6e8fc222e73bb88a589256fac0577452b6ffaaec58adf2b5e216f8a27404c4717a74f239ce73226385133764b75baa775b25de4a0

  • SSDEEP

    196608:u9+8ZspGS5puzUZqVBU6NABaScfR3xeUDyzfS/FNgeLCtNP:u9+EEp5ZqPBOhcftAUDyzqNutNP

  Score

  10^/10

  skuldstealerpersistence

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2