darkcomet

General

Target

77da778ccaeff7f0d95047e74b0c502fa641fc5aec1d5b5fc720b3137a1404d2
Size

680KB
Sample

201109-qwakhekves
MD5

9a47446fa7fc71301cc90d5f4279a68d
SHA1

65106fd2cba8d691d882e3cb76428bfa8f3f5314
SHA256

77da778ccaeff7f0d95047e74b0c502fa641fc5aec1d5b5fc720b3137a1404d2
SHA512

0f24a563878423fe4417eb976110c53e0567c55759c588a2bee1671ec70568bd4bdaf6905decc63e67f85ca170f5c794d554b9540435f379bb156d73affae8e5

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
25
Username:
[email protected]
Password:
olade12ktie8us7

Extracted

Family

darkcomet

Botnet

lowi

C2

fredchen.gotdns.ch:1604

fredchen.gotdns.ch:200

fredchen.gotdns.ch:21

fredchen.gotdns.ch:22

fredchen.gotdns.ch:23

fredchen.gotdns.ch:24

fredchen.gotdns.ch:25

fredchen.gotdns.ch:53

fredchen.gotdns.ch:52

fredchen.gotdns.ch:51

fredchen.gotdns.ch:50

fredchen.gotdns.ch:54

fredchen.gotdns.ch:55

fredchen.gotdns.ch:80

fredchen.gotdns.ch:81

fredchen.gotdns.ch:82

fredchen.gotdns.ch:83

fredchen.gotdns.ch:443

fredchen.gotdns.ch:110

fredchen.gotdns.ch:111

Mutex

DC_MUTEX-HK7QWNG

Attributes

InstallPath
Driver\csrss.exe
gencode
uQ8Z9YNB2JTt
install
true
offline_keylogger
true
password
imperator
persistence
true
reg_key
Services

Targets

- Target
  
  77da778ccaeff7f0d95047e74b0c502fa641fc5aec1d5b5fc720b3137a1404d2
- Size
  
  680KB
- MD5
  
  9a47446fa7fc71301cc90d5f4279a68d
- SHA1
  
  65106fd2cba8d691d882e3cb76428bfa8f3f5314
- SHA256
  
  77da778ccaeff7f0d95047e74b0c502fa641fc5aec1d5b5fc720b3137a1404d2
- SHA512
  
  0f24a563878423fe4417eb976110c53e0567c55759c588a2bee1671ec70568bd4bdaf6905decc63e67f85ca170f5c794d554b9540435f379bb156d73affae8e5
Score

10^/10

darkcomet lowi discovery evasion persistence rat spyware stealer trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2