Extracted

• • Target

    FOV V3.exe

  • Size

    823KB

  • MD5

    1edd3d641b7e918b96c850978265abc8

  • SHA1

    fe57b6f2fef34cd85ae9d69ca66e4fbb7c8aaceb

  • SHA256

    2f80986e756c1e8ee270a78c604c36b279b6ebf48f68854306621c985288bfd9

  • SHA512

    9bdc1a507b4d51b8343c5da5b812bb3e20b0498614607e09e5820ea489794b70b003bbb7809a403a2819fa975ac121a268a91ccca62b2e4819c0e9bdc5265a50

  • SSDEEP

    24576:fxwn6EI8mR614k7TkTPQseEVR3zsQBVD6VmFCAQvyt8R:5wnfmRE48TG6EVB5VD6I8jR

  Score

  10^/10

  darkcometsazandefense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1