Overview

overview

10

Static

static

8

e1761b88f8...89.exe

windows7_x64

10

e1761b88f8...89.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1761b88f8654510f8412e5700e5d61221b7a1dcf0def40f52c2445e029a7489

  • Size

    768KB

  • Sample

    210515-92lg6lqthj

  • MD5

    899337cce4b767d4bec2c815b8ad3a93

  • SHA1

    69fdf433387745a9fccf3c4cba5c25de13b4e050

  • SHA256

    e1761b88f8654510f8412e5700e5d61221b7a1dcf0def40f52c2445e029a7489

  • SHA512

    fe8696c89688fb588481d17b398ce5514fd4f174daa4e1bee316708b4ef52388e92397dcd3a331001bb6ec7b3fd7014b729b250ceee893a184a283af82872351

Score
10/10
darkcometevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      e1761b88f8654510f8412e5700e5d61221b7a1dcf0def40f52c2445e029a7489

    • Size

      768KB

    • MD5

      899337cce4b767d4bec2c815b8ad3a93

    • SHA1

      69fdf433387745a9fccf3c4cba5c25de13b4e050

    • SHA256

      e1761b88f8654510f8412e5700e5d61221b7a1dcf0def40f52c2445e029a7489

    • SHA512

      fe8696c89688fb588481d17b398ce5514fd4f174daa4e1bee316708b4ef52388e92397dcd3a331001bb6ec7b3fd7014b729b250ceee893a184a283af82872351

    Score
    10/10
    darkcometevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks