General
-
Target
8cf4b09c013b583515894483ee4677831da9abdd031215b7129994170108bf47
-
Size
658KB
-
Sample
220417-sqjsrshcak
-
MD5
8899aa46145889974270e7e2077d36b8
-
SHA1
ccd586872274f37bd9c612594719f83124a26071
-
SHA256
8cf4b09c013b583515894483ee4677831da9abdd031215b7129994170108bf47
-
SHA512
6747a2f7874b711cdc41a2dd76ed3073508cb104cd7f8f7e4a215966ad820417786ace600fff62fa98018b4d8af87d0325ab864519221d71dd0bf958e8d7e3d6
Behavioral task
behavioral1
Sample
8cf4b09c013b583515894483ee4677831da9abdd031215b7129994170108bf47.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
Sazan
esxcatty.duckdns.org:1604
DC_MUTEX-8SPQRNE
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
s8oBWPt7xvyh
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
8cf4b09c013b583515894483ee4677831da9abdd031215b7129994170108bf47
-
Size
658KB
-
MD5
8899aa46145889974270e7e2077d36b8
-
SHA1
ccd586872274f37bd9c612594719f83124a26071
-
SHA256
8cf4b09c013b583515894483ee4677831da9abdd031215b7129994170108bf47
-
SHA512
6747a2f7874b711cdc41a2dd76ed3073508cb104cd7f8f7e4a215966ad820417786ace600fff62fa98018b4d8af87d0325ab864519221d71dd0bf958e8d7e3d6
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-