Overview

overview

10

Static

static

02811b25e5...d8.exe

windows7_x64

10

02811b25e5...d8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02811b25e52053553af9b1edf031e2e83cdc7a80b68e45fbca1617872dee55d8

  • Size

    520KB

  • Sample

    210922-qmvprafdbn

  • MD5

    642a19d61f9d148344d263180d4e386a

  • SHA1

    e5005eab11acaec13e0c6a2af0744d99727b1d07

  • SHA256

    02811b25e52053553af9b1edf031e2e83cdc7a80b68e45fbca1617872dee55d8

  • SHA512

    2a337f1910cf046e6b0964430b029a2213d9966f9208df3a9614bc178c6743b48401ea9ee87886b404131c50449f82abdb0796c6c5c3344c5186e5fd877b57db

Score
10/10
darkcometpersistencerattrojanupx

Malware Config

Targets

    • Target

      02811b25e52053553af9b1edf031e2e83cdc7a80b68e45fbca1617872dee55d8

    • Size

      520KB

    • MD5

      642a19d61f9d148344d263180d4e386a

    • SHA1

      e5005eab11acaec13e0c6a2af0744d99727b1d07

    • SHA256

      02811b25e52053553af9b1edf031e2e83cdc7a80b68e45fbca1617872dee55d8

    • SHA512

      2a337f1910cf046e6b0964430b029a2213d9966f9208df3a9614bc178c6743b48401ea9ee87886b404131c50449f82abdb0796c6c5c3344c5186e5fd877b57db

    Score
    10/10
    darkcometpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks