Extracted

Extracted

• • Target

    763f992e8d36d950ef166ca66f95d4d1cab1ba95419987e8a0281cbffc9257d6

  • Size

    757KB

  • MD5

    7b8560ae8ce17f43bddc807c78d36457

  • SHA1

    aff2be4f4dceb4847608d6718fcdfa0958322157

  • SHA256

    763f992e8d36d950ef166ca66f95d4d1cab1ba95419987e8a0281cbffc9257d6

  • SHA512

    dd670da215d25b8f9791c082b646620accc82d991cc8ed3f3a9ce384a60e113b652946fb4d0c7dab0b2d03f7c4e4539bb73b84394a3054d4460cc990accd7462

  • SSDEEP

    12288:D9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h7nkQ:NZ1xuVVjfFoynPaVBUR8f+kN10EBtkQ

  Score

  10^/10

  darkcometlatentbotrobertdefense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Modifies WinLogon for persistence

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9