General
-
Target
1f9ff29afc60eebf41511416db4988007f3d041744574ac144f88eaf82e52b25
-
Size
1.5MB
-
Sample
200624-n9b7eq6bqe
-
MD5
a2d1d72360a93ba7ac24a2abe420c8fa
-
SHA1
43344ec45ed137deec2b9c8e38eeb1c6d54b4cab
-
SHA256
1f9ff29afc60eebf41511416db4988007f3d041744574ac144f88eaf82e52b25
-
SHA512
5f64c4dc8d5ba47ed73da71bcbc040c2f9acc8e48daf31c485c2f988df11c968fd235de779f517e208044e6aa88fe8a30cdb70c10f29557ebaba7b95b88ac76f
Static task
static1
Behavioral task
behavioral1
Sample
1f9ff29afc60eebf41511416db4988007f3d041744574ac144f88eaf82e52b25.exe
Resource
win7
Behavioral task
behavioral2
Sample
1f9ff29afc60eebf41511416db4988007f3d041744574ac144f88eaf82e52b25.exe
Resource
win10v200430
Malware Config
Extracted
darkcomet
Guest16
192.168.42.149:1604
DC_MUTEX-DHCS0WN
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
PeRqGsgi7a6R
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
1f9ff29afc60eebf41511416db4988007f3d041744574ac144f88eaf82e52b25
-
Size
1.5MB
-
MD5
a2d1d72360a93ba7ac24a2abe420c8fa
-
SHA1
43344ec45ed137deec2b9c8e38eeb1c6d54b4cab
-
SHA256
1f9ff29afc60eebf41511416db4988007f3d041744574ac144f88eaf82e52b25
-
SHA512
5f64c4dc8d5ba47ed73da71bcbc040c2f9acc8e48daf31c485c2f988df11c968fd235de779f517e208044e6aa88fe8a30cdb70c10f29557ebaba7b95b88ac76f
Score10/10-
Modifies WinLogon for persistence
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-