Overview

overview

10

Static

static

8

8237c56fb8...57.exe

windows7_x64

10

8237c56fb8...57.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

  • Size

    251KB

  • Sample

    201113-scgp1zpta6

  • MD5

    530119807d27adea9b69bcbf9aad4f0b

  • SHA1

    37c487c8363d9f4e730772ceb135e1a3d330b121

  • SHA256

    8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

  • SHA512

    295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

Score
10/10
darkcometevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

    • Size

      251KB

    • MD5

      530119807d27adea9b69bcbf9aad4f0b

    • SHA1

      37c487c8363d9f4e730772ceb135e1a3d330b121

    • SHA256

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

    • SHA512

      295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

    Score
    10/10
    darkcometevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks