Extracted

• • Target

    43e23ddaf45012061ea60e5aa62c9e70d9028ae13c477f5ae17cf7be7fb05384

  • Size

    253KB

  • MD5

    1f7ff13139b885b00de51893a790f800

  • SHA1

    ec7523a0a1744722f91fc82340bea00490fa4ed8

  • SHA256

    43e23ddaf45012061ea60e5aa62c9e70d9028ae13c477f5ae17cf7be7fb05384

  • SHA512

    1f7491e22c87569269f67842f8385ae61eb9a05dd4d60b46d84706c4b0059feb6a008eaf984cadd933d32e1dda04ad63392c69a0861c1122e39b30c2a3f80588

  • SSDEEP

    6144:DBJVqu5jxRl+t6Ge0qw0kw9+Ks9a8/7z6lnv:DtqwjxRl+t6GfL7zcv

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Windows security bypass

    defense_evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2