Extracted

• • Target

    d025f97d1f87756e37c92fa36aae1223a4975abb515689a63bdb6f4dff25fa9d.exe

  • Size

    1.9MB

  • MD5

    11f5bd6f572e54c86b340457c3047e70

  • SHA1

    f5adc7acd43fa20539f255067ea98dd0b5ef7004

  • SHA256

    d025f97d1f87756e37c92fa36aae1223a4975abb515689a63bdb6f4dff25fa9d

  • SHA512

    fa43cce43a1ad9cbb10d0457ed4f9d3cdc3b910cc28734608566016c5b921368e11337e9fafcc31c7356bf33b4de8bde5b49b0cdc3e507404bef09ec76738105

  • SSDEEP

    49152:E91DSeK3K1ovWnZ5Yw9NMZ6Pkew933XyrCCC0x:MNSeb1n5YEi0Pm93yF

  Score

  10^/10

  darkcometrevengerategodiscoverypersistenceratstealertrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • RevengeRat Executable

    stealer

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2