Extracted

• • Target

    DarkComet_-_v.5.3.1_FWB.zip

  • Size

    15.2MB

  • MD5

    2198e442609a28a84653d700ef1fb501

  • SHA1

    c6caa5d1b457de542f04d5845d67c5c7676db148

  • SHA256

    adbc98dac44fb8972064a49ebb3112bd4fd0cdee6717a19bcc18553321a068d6

  • SHA512

    cff1a782b912a44af8ab12770b2a76dd494ae8fdc596b0c7f67ff1e2902f72cdf3807a6675dec4972ed7459bd1c47eaa839c7fb04fa4004b2214de0f1965bdf7

  • SSDEEP

    393216:uFj55EAdqMASOu3kIxQbtTXQpeaFmPxwX+8uKzk:uFF5dmSONxbtTAkaF0o+80

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1