Extracted

• • Target

    .bat

  • Size

    658KB

  • MD5

    f3aa40d99430ccb842392a6aac95a1b6

  • SHA1

    9db9c6b9f0c790f783d359164b31f113ea79e3dc

  • SHA256

    59e8f27e60ae878c8bc61b59f6a21a547c6d4c27afb47fa614efbe8e116513b3

  • SHA512

    1d0c9f4c9badad6891b4cf8cf0d0cafbe14c39ffb837dac28da338bf7a111524fd5afb1a0f78e8d7b674798ff38d3e840b60b973e6adc16a5e33038fbc614a14

  • SSDEEP

    12288:S9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFa:+iBIGkbxqEcjsWiDxguehC2Sd

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1