Extracted

• • Target

    327537f55eceaab5b0e0f730f36c1c0b435ac46606a6872dc20c6ea5cde079b8.exe

  • Size

    3.8MB

  • MD5

    38959c4ad7220cbf677b327e6e825925

  • SHA1

    088943e624dc2a6ddbc73501afb192af5375c228

  • SHA256

    327537f55eceaab5b0e0f730f36c1c0b435ac46606a6872dc20c6ea5cde079b8

  • SHA512

    dd4e19594e2b217e15d0cbbc4b01cc14049abe325ac474f275a44d26448386dad006936857c20960280c8c70134fedd47bd12edaacaf1c4adb31d1a783a54459

  • SSDEEP

    98304:vJwakG4fYrq1HJvpliCQHawbzBbGSlaUEI96kdQDanpqHrO3ndI3/lL/v7zVwwX6:vJwakG4fYrq1HJvpliCQHawbzBbGSlao

  Score

  10^/10

  darkcomettoakdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2