Extracted

• • Target
    winrar-x64-723tr.exe
  • Size 3.7MB
  • SHA256 cffdebf3b84cc6d24452d2d40055dbff5f6588dddcec46aaefe8fd6aa44d0744
  • MD5 95c12321d4f5d0b2e6e86537ff6e5dd8
  • SHA1 982abb7f67d8180ce4892202d19ac5e68b8d097d
  • SHA512 81b65dd1b16d4a3269a8f54758fb5f7a08204ea4dcb0a9a52bad7d84bf9464a9aa3e71fc0a16e55237e55130651ba9be01fe42c8a7f3e488e64f4890f9dcd7af
  • SSDEEP 98304:AqBAKXJtzIEtTKDpDeEhSBq6ZxFDG1sd:FDIEtG8JpFDG2d
  • TLSH
    T11206232AD6A914F4E177E538C8E20506DA737CAE477093CF33AD19962F237910E39B61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  guest16defense_evasiondiscoveryexecutiondarkcometpersistenceprivilege_escalationransomwarerattrojanvmprotect

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Looks for VMWare Tools registry key

    defense_evasion

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Writes a Windows system DLL name to a user directory

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Modifies WinLogon for persistence

    persistence

  • Suspicious use of SetThreadContext

  behavioral1