General
-
Target
2643fbabf67dfe0de347951a8586a6d945610cb7ee4cacd27c4b83be93aba301
-
Size
1.5MB
-
Sample
210228-vgtpbm7qga
-
MD5
8f96ab46a0be45d68388cc02c8f0e18d
-
SHA1
5f4efe013409e483b0d98d5d913f5ca22c609301
-
SHA256
2643fbabf67dfe0de347951a8586a6d945610cb7ee4cacd27c4b83be93aba301
-
SHA512
2e200ffeecdd6e7ab3c78788c9f81b6a6c07ba20e2096bb27d62b47ba34fd0da9bdf21a2c72493c79e702fe8c934d379a4bc53e93c4ca6a296797073b57d637e
Static task
static1
Behavioral task
behavioral1
Sample
2643fbabf67dfe0de347951a8586a6d945610cb7ee4cacd27c4b83be93aba301.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2643fbabf67dfe0de347951a8586a6d945610cb7ee4cacd27c4b83be93aba301.exe
Resource
win10v20201028
Malware Config
Extracted
darkcomet
Guest16
ronaldoqq.duckdns.org:1604
DC_MUTEX-3451FFA
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
b0aGszBoAx7P
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
2643fbabf67dfe0de347951a8586a6d945610cb7ee4cacd27c4b83be93aba301
-
Size
1.5MB
-
MD5
8f96ab46a0be45d68388cc02c8f0e18d
-
SHA1
5f4efe013409e483b0d98d5d913f5ca22c609301
-
SHA256
2643fbabf67dfe0de347951a8586a6d945610cb7ee4cacd27c4b83be93aba301
-
SHA512
2e200ffeecdd6e7ab3c78788c9f81b6a6c07ba20e2096bb27d62b47ba34fd0da9bdf21a2c72493c79e702fe8c934d379a4bc53e93c4ca6a296797073b57d637e
Score10/10-
Modifies WinLogon for persistence
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-