Overview

overview

10

Static

static

ac7730946c...f1.exe

windows7_x64

10

ac7730946c...f1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1

  • Size

    1.9MB

  • Sample

    210515-mzhekrtbvn

  • MD5

    ba3851b7a3b93b34ab082dd184b01969

  • SHA1

    04a9cf0d8a973c9de96dae6fd830f9780512424d

  • SHA256

    ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1

  • SHA512

    4765f079e434990360f34c3bf8c90d9e48ba0ff988a3a2d2edacf30085eb6a8ce10af3677d199a5830bd80278965674afac15e79438872946d2213268324e121

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1

    • Size

      1.9MB

    • MD5

      ba3851b7a3b93b34ab082dd184b01969

    • SHA1

      04a9cf0d8a973c9de96dae6fd830f9780512424d

    • SHA256

      ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1

    • SHA512

      4765f079e434990360f34c3bf8c90d9e48ba0ff988a3a2d2edacf30085eb6a8ce10af3677d199a5830bd80278965674afac15e79438872946d2213268324e121

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks