Extracted

• • Target

    msdcsc.exe_pw_infected.zip

  • Size

    350KB

  • MD5

    7e62dc3f267de17a09f388342aafddcd

  • SHA1

    928d72b5e52b56a44d18f160efb0119b8d6f9f76

  • SHA256

    7b81f22a76c83b176e760f6957f6e86019660656ea94a73f880b4085bcfc7957

  • SHA512

    62599139ad38b71db7dbde330270e8b9328e1e9166cd10a998e170e684a866ba06c67bab538ae46414b348bcdf4acd7b8135e2e265599b89c0ce8dca6fab462d

  • SSDEEP

    6144:htEchjN1JPhpSXXpVf5MO0/wFPpT3YqGJ0SewGft0hetuhX7FlZLa66p2BtR5ZOC:PtxAVf5GwBV3CJLewG10hOM7ZW6/2w+M

  Score

  1^/10
  behavioral1

• • Target

    0x0007000000019273-20

  • Size

    658KB

  • MD5

    3178fcad2d2c2f3c0f4f70aecfb18db7

  • SHA1

    0ecad6522214f9bef4dd8f2f8eb927827bc4971c

  • SHA256

    dd8650f0e484ba0ea4775ccce3a9644bba747ee92f1b534628525c7ceedc69f9

  • SHA512

    57148c860850344b1086c8765c083862d57d99119914e218aca4c8e80dc9cbe48d206b6aefaea9ad5cda58a459ff5888f1bc82f6fabacd2aa81f52818cef4985

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hV:KZ1xuVVjfFoynPaVBUR8f+kN10EBP

  Score

  10^/10

  darkcometguest16defense_evasiondiscoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral2