Overview

overview

10

Static

static

338aaa91f6...8e.exe

windows7_x64

10

338aaa91f6...8e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    338aaa91f6ecfed6f87d6b4e2df7eb8e

  • Size

    13.8MB

  • Sample

    201117-tfwy2carwa

  • MD5

    44f30513e915e75f70b65334aaea575f

  • SHA1

    f289bfa5fdfd20c1299373f4b27dfae3959a30a9

  • SHA256

    8747896fc2d331a7dc2f3f216e4af54da9b02fecc3e17172de74ed0b85f9ce09

  • SHA512

    76d30d43bac15f36ab08e7cfbd969f8e603aa48f041e07fa05497e83edb586dfab0ad80b27cfbb850cd1379ba0387f3ac3939f920c466f249c07e1a6f6597a03

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      338aaa91f6ecfed6f87d6b4e2df7eb8e

    • Size

      13.8MB

    • MD5

      44f30513e915e75f70b65334aaea575f

    • SHA1

      f289bfa5fdfd20c1299373f4b27dfae3959a30a9

    • SHA256

      8747896fc2d331a7dc2f3f216e4af54da9b02fecc3e17172de74ed0b85f9ce09

    • SHA512

      76d30d43bac15f36ab08e7cfbd969f8e603aa48f041e07fa05497e83edb586dfab0ad80b27cfbb850cd1379ba0387f3ac3939f920c466f249c07e1a6f6597a03

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks