Extracted

• • Target

    a4b196e112825232a260725c2651764ad8d2bdcc5974ee4b0a9c635c14b0eb10

  • Size

    690KB

  • MD5

    45bfee45177d62952de9c03f661c4b1a

  • SHA1

    e12804084039f235b768a21594c9e20b9ddb0d1b

  • SHA256

    a4b196e112825232a260725c2651764ad8d2bdcc5974ee4b0a9c635c14b0eb10

  • SHA512

    288247162e0cd2dca6e0d51890a70694a2ffaf0b0983f41f0048271c74af16a9eb8175c0e9f6fd91325ca93423aafd6816278e93520308ce53372e4f848f1264

  • SSDEEP

    12288:f9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h9lI:JZ1xuVVjfFoynPaVBUR8f+kN10EBW

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9