Extracted

• • Target

    gay.vmp.exe

  • Size

    5.4MB

  • MD5

    2d1fd41cbc1769d934cb3093e6f8063a

  • SHA1

    72de3c4a9969415fcd973e6d9a4b0b19d892f4f2

  • SHA256

    88d4d2554bb064ad0db74fd3fb97bff1325dbe751e4d21bda0ffc3d0bf5e3cd2

  • SHA512

    636a62e8ee870bd6b076961f4d97db7eb8a3ece57d60cfbe2a65a0ece084d9157b8c985fba014d1dbfbc7d2bcebecdc58f9cbc9e1f8ca0c3a6c5592a8e7f23f5

  • SSDEEP

    98304:2l2uqawox97EzdtHtaU6ZJi0RueilG11U0xDYxFUPFUJh610:2l2uqawESdtHtt6Z9Y811UX+P5C

  Score

  10^/10

  darkcometdefense_evasiondiscoverypersistencerattrojanvmprotect

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2