Overview

overview

10

Static

static

183d7b9520...0f.exe

windows7_x64

10

183d7b9520...0f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    183d7b9520584c2779641472fc9d98feb1a7b68f7a7a510cdc271a795311700f

  • Size

    1.9MB

  • Sample

    210508-dgj4f69axs

  • MD5

    b4dcd2d1d30d94db8313fff13fcec458

  • SHA1

    bb77b06b84e44bbf191caaf93bf63928bcff9669

  • SHA256

    183d7b9520584c2779641472fc9d98feb1a7b68f7a7a510cdc271a795311700f

  • SHA512

    26cfe666dadc7473d46b2eac42de712a20559e56d5f071af3ffdacde183895983ce1b6f4cf922d50112f6e92aeb31c9ea8df101c1eeaeb6b0b67d8f775229a9f

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      183d7b9520584c2779641472fc9d98feb1a7b68f7a7a510cdc271a795311700f

    • Size

      1.9MB

    • MD5

      b4dcd2d1d30d94db8313fff13fcec458

    • SHA1

      bb77b06b84e44bbf191caaf93bf63928bcff9669

    • SHA256

      183d7b9520584c2779641472fc9d98feb1a7b68f7a7a510cdc271a795311700f

    • SHA512

      26cfe666dadc7473d46b2eac42de712a20559e56d5f071af3ffdacde183895983ce1b6f4cf922d50112f6e92aeb31c9ea8df101c1eeaeb6b0b67d8f775229a9f

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks