General
-
Target
7f302af881787140a57111123ef02539b6453dbe7cd61df881cbec9ac443ec87
-
Size
252KB
-
Sample
201112-aqxjdypbjj
-
MD5
f7e38e4a8a47b047e6f295aeb9f503cf
-
SHA1
1ff67e17be21a81d92b56f9879f5c918e56a378c
-
SHA256
7f302af881787140a57111123ef02539b6453dbe7cd61df881cbec9ac443ec87
-
SHA512
122c36e8c0562cc41c66ac2d4551f792a065d42511ae058d4ed2a5a11f9d52f763c7bec8dc8485edcfc47157bd2ccd34c99dc60b47a6c36fc9857f7867ce78aa
Static task
static1
Behavioral task
behavioral1
Sample
7f302af881787140a57111123ef02539b6453dbe7cd61df881cbec9ac443ec87.exe
Resource
win7v20201028
Malware Config
Extracted
darkcomet
Guest16
ximer2020.ddns.net:1604
DC_MUTEX-4U0HFC0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
aDFqoxfKfrcR
-
install
true
-
offline_keylogger
true
-
password
82121020202222
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
7f302af881787140a57111123ef02539b6453dbe7cd61df881cbec9ac443ec87
-
Size
252KB
-
MD5
f7e38e4a8a47b047e6f295aeb9f503cf
-
SHA1
1ff67e17be21a81d92b56f9879f5c918e56a378c
-
SHA256
7f302af881787140a57111123ef02539b6453dbe7cd61df881cbec9ac443ec87
-
SHA512
122c36e8c0562cc41c66ac2d4551f792a065d42511ae058d4ed2a5a11f9d52f763c7bec8dc8485edcfc47157bd2ccd34c99dc60b47a6c36fc9857f7867ce78aa
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-