General
-
Target
1.bin
-
Size
661KB
-
Sample
220225-gy1kpsfbc9
-
MD5
f0e7f5c44d69cb03d87b634c3d695c7e
-
SHA1
f46ef1eb3ba47a62ebf645238aad3af66ebed012
-
SHA256
1f2ead28ecdc21f65c33e8f929466d39cd618c25b1ff488eaadd27302022bda5
-
SHA512
07f66d65f728887b755137c07fd1f3941c92f6fb7dd10d3ea59e30031ac2e96cd77cfc0c364a51441047b87102b9f81ec766698ec776dcffa141d6dcdf0560fc
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220223-en
Malware Config
Extracted
darkcomet
Sazan
akordion.duckdns.org:1604
DC_MUTEX-CADHQZA
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
344KSen6NjLL
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
1.bin
-
Size
661KB
-
MD5
f0e7f5c44d69cb03d87b634c3d695c7e
-
SHA1
f46ef1eb3ba47a62ebf645238aad3af66ebed012
-
SHA256
1f2ead28ecdc21f65c33e8f929466d39cd618c25b1ff488eaadd27302022bda5
-
SHA512
07f66d65f728887b755137c07fd1f3941c92f6fb7dd10d3ea59e30031ac2e96cd77cfc0c364a51441047b87102b9f81ec766698ec776dcffa141d6dcdf0560fc
-
Modifies WinLogon for persistence
-
Modifies security service
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-