Extracted

Extracted

• • Target

    9fdbd2a7d21d38f8a1f2992d5a911d11670d745beb3b495153529818ec116e22

  • Size

    1.1MB

  • MD5

    971e273f808bae7da52ad62dbb050206

  • SHA1

    78bebe22816e3fb380cbf0caa11776ff4b120686

  • SHA256

    9fdbd2a7d21d38f8a1f2992d5a911d11670d745beb3b495153529818ec116e22

  • SHA512

    d47fb2a4c2627a1212ff7db3fb443e1b0739a561a82e588c3aff21a2db591ae1cddc2186c4915e180fcb8fc965e42fba3feeb5135d90388fe35a47f35403199e

  • SSDEEP

    24576:umoO8itnTaZsZfZ8ARL28WcVNGAQnmMCL+tMEekEoKwsbovX:FleZsZfj2tcKALZm5ekEoKpkf

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2