Extracted

Extracted

• • Target

    6a8f1e064f0b2da3fa45022c5ed1408256c8f12c9631442eb5930277916485f5.exe

  • Size

    283KB

  • MD5

    bff9a9f371171e16afab59da8dfdc680

  • SHA1

    4c5c35c997754b5d99907b4c4c1c45d08b37cc0f

  • SHA256

    6a8f1e064f0b2da3fa45022c5ed1408256c8f12c9631442eb5930277916485f5

  • SHA512

    e979fb4525aca5d8314bbc2c9e6241859771ac425606921260d2cd8d6e9aacb6c5d9a8105c3b260d9d4a7f7c88936077dd6375f69d5050331d679a3031b1ee64

  • SSDEEP

    6144:ycNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37hjWX:ycW7KEZlPzCy37hjWX

  Score

  10^/10

  darkcomettiodiscoveryevasionpersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2