Overview

overview

10

Static

static

Temmuz 202...su.exe

windows7_x64

10

Temmuz 202...su.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Temmuz 2020 Bayi-Personel Prim Kazanc Tablosu.exe

  • Size

    1.1MB

  • Sample

    200806-1mtljmzzrs

  • MD5

    e255489d5f3e363d714ee0cecf55fe34

  • SHA1

    abee71dd7a24cb405390fa25e24297ac6e520809

  • SHA256

    92bae130f70a00a0207adfa078c44f57a9c6326c8873847f99acc8d3398b5f7a

  • SHA512

    6cb359bccc3834973481a089cf3e3a30d0948242579351e9e3f1de352215a50602b3624cb54954be538f4b13fcb9bbbb054d4683a5677100429b35aa6f9fb697

Score
10/10
darkcometmodiloaderpersistencerattrojan

Malware Config

Targets

    • Target

      Temmuz 2020 Bayi-Personel Prim Kazanc Tablosu.exe

    • Size

      1.1MB

    • MD5

      e255489d5f3e363d714ee0cecf55fe34

    • SHA1

      abee71dd7a24cb405390fa25e24297ac6e520809

    • SHA256

      92bae130f70a00a0207adfa078c44f57a9c6326c8873847f99acc8d3398b5f7a

    • SHA512

      6cb359bccc3834973481a089cf3e3a30d0948242579351e9e3f1de352215a50602b3624cb54954be538f4b13fcb9bbbb054d4683a5677100429b35aa6f9fb697

    Score
    10/10
    darkcometmodiloaderpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks