Extracted

• • Target

    dada691679ed350177d465ec4f82d5726d150fbfe244b352c002967ad0e9d6c5N.exe

  • Size

    964KB

  • MD5

    684ccaf0a9ef445cbbc8580921e1d900

  • SHA1

    b3ddc721476d552d58b8177ba8824ecc1de03bd7

  • SHA256

    dada691679ed350177d465ec4f82d5726d150fbfe244b352c002967ad0e9d6c5

  • SHA512

    a3cfefdd2df560f18359ee4c1f3d8a7b27516be525251e5dd3a685c5af0ecdfc859e6203de5f1e4f2956ff7ce22799b0daa3f2bb9b3d2dfec93485869c25e591

  • SSDEEP

    24576:EUn1IgB1wd4EaaR9u68GGUEtUMefQMmNohkX:FIQEaaRM68MMPOhM

  Score

  10^/10

  darkcometabovedefense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2