Extracted

• • Target

    3ff1c7d87a0a6c981923823c4bc4fbb00c9812ea14c7dbd2439864121b9d718a

  • Size

    589KB

  • MD5

    9755c15f9f8af5a6fa8e38b4aaf43958

  • SHA1

    d17b8d4431713bf3aa61753c12dd42ffa7a54f74

  • SHA256

    3ff1c7d87a0a6c981923823c4bc4fbb00c9812ea14c7dbd2439864121b9d718a

  • SHA512

    14e1d0708f8c0d4497a1c192592ff058e79f5126ad3722d1220947b913b98938db594da861ab159091b42b018a85841ac38b87824a1d59b6ae1e8c3c6f87f219

  • SSDEEP

    12288:9ffLtEIQIu7k5sscLsD5iZqHyscNExmj1NT5BzYQR8NxOz8Y5oSQ:9fTOIQIu7k5DzvLxm5Bl8sA

  Score

  10^/10

  darkcometbotnetdiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2