General

  • Target

    5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239

  • Size

    1MB

  • Sample

    220502-eaj7psbeh3

  • MD5

    03eded5108ae1519bdb97a27dfac2ff0

  • SHA1

    b6a6aa3e1d66b0b774573c0b522947912091d36d

  • SHA256

    5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239

  • SHA512

    bef373872833ba3a650accfa79730c1ba98c6bd23e5773a9955833836385c6488ec4326e915b5534085c08bde407073c3e9bc0e888cd5c46e287ea91281d8d3f

Malware Config

Extracted

Family

darkcomet

Botnet

1

C2

anthraxgold.no-ip.info:666

Attributes
gencode
M6QvjZgri1v2
install
false
offline_keylogger
false
persistence
false

Targets

    • Target

      5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239

    • Size

      1MB

    • MD5

      03eded5108ae1519bdb97a27dfac2ff0

    • SHA1

      b6a6aa3e1d66b0b774573c0b522947912091d36d

    • SHA256

      5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239

    • SHA512

      bef373872833ba3a650accfa79730c1ba98c6bd23e5773a9955833836385c6488ec4326e915b5534085c08bde407073c3e9bc0e888cd5c46e287ea91281d8d3f

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation