Overview

overview

10

Static

static

066fb23653...e7.exe

windows7_x64

10

066fb23653...e7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    066fb23653213f32232fd0ef427060489572276a44b76ab546b8e111f13925e7

  • Size

    1.9MB

  • Sample

    210515-ldn1ktn48n

  • MD5

    b6cb032362de6f539cb1f3aed899f3bf

  • SHA1

    3af5291220a7a626a8a3c7a4b9c07b6b06284118

  • SHA256

    066fb23653213f32232fd0ef427060489572276a44b76ab546b8e111f13925e7

  • SHA512

    a063d3832b27db4650b2fc27947129bbc5d5cf1da954ad4e44060e760d02fb6c51cdf98fd85ec897bab4fad07c52a63a7e6a4a8a4319e1c2023101754654c96c

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      066fb23653213f32232fd0ef427060489572276a44b76ab546b8e111f13925e7

    • Size

      1.9MB

    • MD5

      b6cb032362de6f539cb1f3aed899f3bf

    • SHA1

      3af5291220a7a626a8a3c7a4b9c07b6b06284118

    • SHA256

      066fb23653213f32232fd0ef427060489572276a44b76ab546b8e111f13925e7

    • SHA512

      a063d3832b27db4650b2fc27947129bbc5d5cf1da954ad4e44060e760d02fb6c51cdf98fd85ec897bab4fad07c52a63a7e6a4a8a4319e1c2023101754654c96c

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks