Extracted

• • Target

    D075589CD45380AAB929C10CE82BABF63533A5025527B1F7F30B55059C5D0AD2

  • Size

    3.0MB

  • MD5

    c5e77ee2c96212dcb64b9ead1b746dd8

  • SHA1

    816610afe4151c9fe59449f30922f68babd665fc

  • SHA256

    d075589cd45380aab929c10ce82babf63533a5025527b1f7f30b55059c5d0ad2

  • SHA512

    2e8418f8b82686a76f83bcf4890909fa2678f7b97c49b02de84f27af2dd503260047983fde4a99a69421dada89caf7db033ade27b1d457e227cc208c02544446

  • SSDEEP

    49152:LAI+iYFsw8ob4+vrrQtgKNnZj/Y4JneyOLHgmk7V5Pz8IF+8Ieg9uRKcT2MOmZuY:LAI+irwbVrsgKrxOLAmk3IIsuIcT2MOg

  Score

  10^/10

  darkcomettheoldbackdiscoveryrattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2