General

  • Target

    9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a

  • Size

    1.5MB

  • Sample

    220502-eafjhsgcgm

  • MD5

    01f1ae0432dc9cef9393df121d512502

  • SHA1

    b1ee440d433494c89ca3a6cb6a4326f02af6c734

  • SHA256

    9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a

  • SHA512

    8670a8fd8b0ea6468bf34bdbe9da07d5b5036f2530fb74ab447c4277caf2b1feb086a076f92749f5fad36d2b76991bd6de2f541d75dbddc0492ff656fbeeaeeb

Malware Config

Extracted

Family

darkcomet

Botnet

1

C2

anthraxgold.no-ip.info:666

Mutex

DC_MUTEX-169BEXQ

Attributes
  • gencode

    M6QvjZgri1v2

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

Targets

    • Target

      9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a

    • Size

      1.5MB

    • MD5

      01f1ae0432dc9cef9393df121d512502

    • SHA1

      b1ee440d433494c89ca3a6cb6a4326f02af6c734

    • SHA256

      9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a

    • SHA512

      8670a8fd8b0ea6468bf34bdbe9da07d5b5036f2530fb74ab447c4277caf2b1feb086a076f92749f5fad36d2b76991bd6de2f541d75dbddc0492ff656fbeeaeeb

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Tasks