Extracted

• • Target

    4a3373593c6cc871dbc9396eb6d29c35948e38df32269d962b7267b0e7ab5c4d.exe

  • Size

    3.9MB

  • MD5

    c46b44926a296e776b82484fa56f43c5

  • SHA1

    19e4d14ec35ed12e46fe596b7da1fe5b07a8aac0

  • SHA256

    4a3373593c6cc871dbc9396eb6d29c35948e38df32269d962b7267b0e7ab5c4d

  • SHA512

    a0721d891277aa8a4648ee0c9e10167e79b879c2c6c9232d2a86c9d7092f6bf22ff0fb4455b60c5f94d50b65eea4bfa45e0d2be4958e8c52fb2f259afe623434

  • SSDEEP

    98304:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5Cc:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBc

  Score

  10^/10

  darkcometwhalediscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2