Overview

overview

10

Static

static

78d9b951e8...2c.exe

windows7_x64

10

78d9b951e8...2c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c

  • Size

    545KB

  • Sample

    210515-z7m8thcf62

  • MD5

    e2c65291f42b8587e4f3bdcfc0c114f0

  • SHA1

    4da09c5b590a278cb38c35c2233ff39d4b4bc788

  • SHA256

    78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c

  • SHA512

    6c2398e7646e6670fef030792ea533a271be67b3e995111b33a05faa2a05a288804f6c085f9841aed53366a9586a764ee0aea27a5e0a42efcb746cc3191e437a

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c

    • Size

      545KB

    • MD5

      e2c65291f42b8587e4f3bdcfc0c114f0

    • SHA1

      4da09c5b590a278cb38c35c2233ff39d4b4bc788

    • SHA256

      78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c

    • SHA512

      6c2398e7646e6670fef030792ea533a271be67b3e995111b33a05faa2a05a288804f6c085f9841aed53366a9586a764ee0aea27a5e0a42efcb746cc3191e437a

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks