Extracted

• • Target

    509f38d2f10000544d741eda3414c1184ada46e5d654729de67fdb025e701497.exe

  • Size

    725KB

  • MD5

    f74b5af14f62bb35a0fee52dce026c95

  • SHA1

    86cebb40fce107ee31313fffe74f477ebaf56cb6

  • SHA256

    509f38d2f10000544d741eda3414c1184ada46e5d654729de67fdb025e701497

  • SHA512

    bb097e493485d2cafbc4b13496d427545233a5b3747af6ea87b1e33a53047c81db09bce4945f5b4b15f464b97b02b20413e818b147aaca0f7b1fec839e09ca65

  • SSDEEP

    12288:P9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hlKM:5Z1xuVVjfFoynPaVBUR8f+kN10EB9

  Score

  10^/10

  darkcometharmfulpoop.no-ip.bizdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2