Overview

overview

10

Static

static

52603d0f72...e1.exe

windows7_x64

1

52603d0f72...e1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    52603d0f72211c3e083c533fe6ff7dac5a3b220cf65825d379bfba8edced77e1

  • Size

    1.9MB

  • Sample

    210515-2y2pyx7xwn

  • MD5

    bd13d800662e95b5ecb2f7c36768b887

  • SHA1

    4c40b991aeefc705624a51a7b4e7436338796aa8

  • SHA256

    52603d0f72211c3e083c533fe6ff7dac5a3b220cf65825d379bfba8edced77e1

  • SHA512

    38d18e6df4cb5af384948204df6b9f780237c44474b959e9d43d78782a0f785d6b26dbf9ca755920376ad5ba02d10f7816cd89981f1b00edde838a188f763069

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      52603d0f72211c3e083c533fe6ff7dac5a3b220cf65825d379bfba8edced77e1

    • Size

      1.9MB

    • MD5

      bd13d800662e95b5ecb2f7c36768b887

    • SHA1

      4c40b991aeefc705624a51a7b4e7436338796aa8

    • SHA256

      52603d0f72211c3e083c533fe6ff7dac5a3b220cf65825d379bfba8edced77e1

    • SHA512

      38d18e6df4cb5af384948204df6b9f780237c44474b959e9d43d78782a0f785d6b26dbf9ca755920376ad5ba02d10f7816cd89981f1b00edde838a188f763069

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks