820f2381fe1860a8b6f9e66032ac4bb79ac6b7b9269264c547e4c63151593df0

General
Target

820f2381fe1860a8b6f9e66032ac4bb79ac6b7b9269264c547e4c63151593df0

Size

732KB

Sample

210921-k435kabfdm

Score
10 /10
MD5

a1c0d1485d1f2ac0d660ea28502e79ae

SHA1

fcd8a01e7c022c086747a680bb8995f9279aaa8c

SHA256

820f2381fe1860a8b6f9e66032ac4bb79ac6b7b9269264c547e4c63151593df0

SHA512

d44e3ecaefe8012aeaf5b3b4adf0d4aa6e2b9cf4565960def0c665d6294f7b21fa006a8d99b4e847b2a2f8eb0e9981bc4ce2f2f377541e53d84295b94108ad1f

Malware Config

Extracted

Family darkcomet
Botnet Sazan
C2

marbeyli.ddns.net:443

Attributes
InstallPath
MSDCSC\svchost.exe
gencode
CTg6jh11p8Xh
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Extracted

Family njrat
Version Njrat 0.7 Golden By Hassan Amiri
Botnet HacKed
C2

marbeyli.ddns.net:5552

Attributes
reg_key
Windows Update
splitter
|Hassan|
Targets
Target

820f2381fe1860a8b6f9e66032ac4bb79ac6b7b9269264c547e4c63151593df0

MD5

a1c0d1485d1f2ac0d660ea28502e79ae

Filesize

732KB

Score
10 /10
SHA1

fcd8a01e7c022c086747a680bb8995f9279aaa8c

SHA256

820f2381fe1860a8b6f9e66032ac4bb79ac6b7b9269264c547e4c63151593df0

SHA512

d44e3ecaefe8012aeaf5b3b4adf0d4aa6e2b9cf4565960def0c665d6294f7b21fa006a8d99b4e847b2a2f8eb0e9981bc4ce2f2f377541e53d84295b94108ad1f

Tags

Signatures

  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

    Tags

  • Darkcomet

    Description

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    Tags

  • Modifies WinLogon for persistence

    Tags

    TTPs

    Winlogon Helper DLL Modify Registry
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

    Tags

  • Async RAT payload

    Tags

  • Executes dropped EXE

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query Registry System Information Discovery
  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation