Overview

overview

10

Static

static

10

f38e9a0aeb...88.exe

windows7_x64

10

f38e9a0aeb...88.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888

  • Size

    820KB

  • Sample

    210504-ytrpcjrkmj

  • MD5

    80e22d59d2388f5b9d6b9560187b281e

  • SHA1

    adbf2306ede7736435cdf204a64ae4748c409ba7

  • SHA256

    f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888

  • SHA512

    0f8485d87a8ae8685fa0393e1bd3d3e6b7bec98a9349c5e0a651deaeda5908b29865b162d0683a74d0688722f555812e9fa1f813819dc1958a709585107172e1

Score
10/10
darkcometguest16rattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-LRSU5E5

Attributes
  • gencode

    z1XtPDQ8LUgm

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888

    • Size

      820KB

    • MD5

      80e22d59d2388f5b9d6b9560187b281e

    • SHA1

      adbf2306ede7736435cdf204a64ae4748c409ba7

    • SHA256

      f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888

    • SHA512

      0f8485d87a8ae8685fa0393e1bd3d3e6b7bec98a9349c5e0a651deaeda5908b29865b162d0683a74d0688722f555812e9fa1f813819dc1958a709585107172e1

    Score
    10/10
    darkcometguest16rattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks