Extracted

• • Target

    0b0342b1428f18d9a1ee09a0fc3f274bd04f599c476616b967be1006497def31.exe

  • Size

    658KB

  • MD5

    1173b438e6ac9fdcf5662d5853b7fa27

  • SHA1

    77e9b351cd69f87899a3bdc17b9175d58c927a14

  • SHA256

    0b0342b1428f18d9a1ee09a0fc3f274bd04f599c476616b967be1006497def31

  • SHA512

    2b61f314e898f72fd829e4a9384e6757c2e7c337ad049d52709b14e16883b6079045deb74943bc0bad94612d15960cd428420274aa1c6ea8bc4446df1f5ff2b4

  • SSDEEP

    12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ho:GZ1xuVVjfFoynPaVBUR8f+kN10EB2

  Score

  10^/10

  darkcometratdiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2