Overview

overview

10

Static

static

81c748b85e...0c.exe

windows7_x64

10

81c748b85e...0c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81c748b85efed22f16c6eff69fbd0f9cc2451ac155c174e296b3834bc1934b0c

  • Size

    819KB

  • Sample

    210515-928tq8rqxx

  • MD5

    9eddc85ea7ea3c5efc80876782915020

  • SHA1

    117a6bce6c740c6470fbe3a01e8377eece671aa7

  • SHA256

    81c748b85efed22f16c6eff69fbd0f9cc2451ac155c174e296b3834bc1934b0c

  • SHA512

    69e74b03cec75e7e8ceb7e291b1140cb09ec3390370dd4f697d05b2e81042a21a60db5147522d583861b2da9bccdc8fa28b806eb42b6301e68d4906979e0b09c

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      81c748b85efed22f16c6eff69fbd0f9cc2451ac155c174e296b3834bc1934b0c

    • Size

      819KB

    • MD5

      9eddc85ea7ea3c5efc80876782915020

    • SHA1

      117a6bce6c740c6470fbe3a01e8377eece671aa7

    • SHA256

      81c748b85efed22f16c6eff69fbd0f9cc2451ac155c174e296b3834bc1934b0c

    • SHA512

      69e74b03cec75e7e8ceb7e291b1140cb09ec3390370dd4f697d05b2e81042a21a60db5147522d583861b2da9bccdc8fa28b806eb42b6301e68d4906979e0b09c

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks