Overview

overview

10

Static

static

6e52961bca...04.exe

windows7_x64

8

6e52961bca...04.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604

  • Size

    1.5MB

  • Sample

    201109-7tkmvrajhe

  • MD5

    142ca1586ebf110c896a2081ee5b9897

  • SHA1

    25675d558ee4bae0e32c78b1d150fa3a1a27666e

  • SHA256

    6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604

  • SHA512

    53266437a8411f8fb1ce9f5d9494de3f73b5b3c948974313b62f4f3b3ee172a092151f59c4ac622255213d31ef25a06bd6ca8654ef0557a25cc9ca0ebe4c468c

Score
10/10
darkcometrunescapepersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Runescape

C2

mrsnickers03.no-ip.biz:340

Mutex

DC_MUTEX-6ZFK11A

Attributes
  • gencode

    uNwew4gojxtu

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604

    • Size

      1.5MB

    • MD5

      142ca1586ebf110c896a2081ee5b9897

    • SHA1

      25675d558ee4bae0e32c78b1d150fa3a1a27666e

    • SHA256

      6e52961bcacef0d2266611273665feee91e924e55a809e50b6a978e0a2867604

    • SHA512

      53266437a8411f8fb1ce9f5d9494de3f73b5b3c948974313b62f4f3b3ee172a092151f59c4ac622255213d31ef25a06bd6ca8654ef0557a25cc9ca0ebe4c468c

    Score
    10/10
    upxdarkcometrunescapepersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks