General
-
Target
46b6eca723ff6847d9ca7faa01668a7a4099fd84996f7b0172138f965e510768
-
Size
892KB
-
Sample
220309-j4m8nsfdb7
-
MD5
c3ef33d077f1471aabf89c3042b0e54a
-
SHA1
ec312ee6026b175c5a73b61b04da1f710fc55a4e
-
SHA256
46b6eca723ff6847d9ca7faa01668a7a4099fd84996f7b0172138f965e510768
-
SHA512
b3e7f023f8ab2d48a2c9f2dd906d44ebd4e61055b8519f0a722985dfd3fcfc90bf3795eead0fc999e692f0a3fa6fee46697e26ed93166a4e0b267deddaccb071
Static task
static1
Behavioral task
behavioral1
Sample
46b6eca723ff6847d9ca7faa01668a7a4099fd84996f7b0172138f965e510768.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
46b6eca723ff6847d9ca7faa01668a7a4099fd84996f7b0172138f965e510768.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
darkcomet
Sazan
ffhjfgkjdfg.tk:45622
DC_MUTEX-CAQ9PVQ
-
InstallPath
SYS\Syscal.exe
-
gencode
qsfrz9ZVMWyN
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
SystemCalculator
Targets
-
-
Target
46b6eca723ff6847d9ca7faa01668a7a4099fd84996f7b0172138f965e510768
-
Size
892KB
-
MD5
c3ef33d077f1471aabf89c3042b0e54a
-
SHA1
ec312ee6026b175c5a73b61b04da1f710fc55a4e
-
SHA256
46b6eca723ff6847d9ca7faa01668a7a4099fd84996f7b0172138f965e510768
-
SHA512
b3e7f023f8ab2d48a2c9f2dd906d44ebd4e61055b8519f0a722985dfd3fcfc90bf3795eead0fc999e692f0a3fa6fee46697e26ed93166a4e0b267deddaccb071
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-