Overview

overview

10

Static

static

8

eefc1f400c...e6.exe

windows7_x64

10

eefc1f400c...e6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eefc1f400c26511a09ac6fdb041fda25b757cef54689ae9d27ac0c68c738b7e6

  • Size

    232KB

  • Sample

    201106-84x3dw8lej

  • MD5

    f0457db9f16446ce936b729c976bfea1

  • SHA1

    839d5c815b7ab8e23b25815dda448aedded498dc

  • SHA256

    eefc1f400c26511a09ac6fdb041fda25b757cef54689ae9d27ac0c68c738b7e6

  • SHA512

    fcec2d68f33415717b6403bfea78583b888e625ef3f56abcf1b655930da56d157cbb18b4a0ea79cd70fba7987e0584b5811f2dc6ef8050e8f7f9e91254cb5f01

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      eefc1f400c26511a09ac6fdb041fda25b757cef54689ae9d27ac0c68c738b7e6

    • Size

      232KB

    • MD5

      f0457db9f16446ce936b729c976bfea1

    • SHA1

      839d5c815b7ab8e23b25815dda448aedded498dc

    • SHA256

      eefc1f400c26511a09ac6fdb041fda25b757cef54689ae9d27ac0c68c738b7e6

    • SHA512

      fcec2d68f33415717b6403bfea78583b888e625ef3f56abcf1b655930da56d157cbb18b4a0ea79cd70fba7987e0584b5811f2dc6ef8050e8f7f9e91254cb5f01

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks