Extracted

• • Target

    ccd06265fecc7d7fee73c0e5d84caab25a9d512a66f3c9b00d9f20e592c4ae28N.exe

  • Size

    3.8MB

  • MD5

    d25d4e2d9d0d4d45ee240fd5dcb86c40

  • SHA1

    1a55586db470b8ed71b6e6df0c6b01b8194fefb7

  • SHA256

    ccd06265fecc7d7fee73c0e5d84caab25a9d512a66f3c9b00d9f20e592c4ae28

  • SHA512

    0a0ac80e60b12884664d40e80600494aeeb73f6c94a9f9037a418934b5270f925c9ac7a4e74efb357134c4f01c6fd4d87fb06a1a4b1752bec33158ff018a529b

  • SSDEEP

    98304:vJwakG4fYrq1HJvpliCQHawbzBbGSlaUEI96kdQDanpqHrO3ndI3/lL/v7zVwwXu:vJwakG4fYrq1HJvpliCQHawbzBbGSlao

  Score

  10^/10

  darkcomettoakdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2