Extracted

• • Target

    1269d0e2254b5b7244a3040f6f6f30be510e89b289e43c57a95ef7e9eb2acd17

  • Size

    746KB

  • MD5

    16033e6fdc377f1d513448e50b17b26e

  • SHA1

    a820b81fef640df0bf88480817d1d0b8e6be4171

  • SHA256

    1269d0e2254b5b7244a3040f6f6f30be510e89b289e43c57a95ef7e9eb2acd17

  • SHA512

    8f7efde7e791cc7ceb763cd9b815619cc25ef90e16db15d435ded885ba8d826f69e801da148b339de61fb29a01f1cb72e4c3aff8f41d2843fb8031eddf0d2bc1

  • SSDEEP

    12288:c6A84PaHhfD/tV9sj5NKR0pau9XGyu2i5NG/hg6Nlh:xAmBpVKHu0Mu9Xo2ENG/XNn

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2