General
-
Target
071e5d531e107b62f71a8854fb446230a73d0ce115be2912cbf505b0e450428b
-
Size
956KB
-
Sample
220508-jhkknabch6
-
MD5
2a4e14eb3b0c1d04ecd67caa1696a6d0
-
SHA1
c7eacf73384cda71c8b0000fadfba37601c71046
-
SHA256
071e5d531e107b62f71a8854fb446230a73d0ce115be2912cbf505b0e450428b
-
SHA512
26c0bdc3e9b0043ba9a266e18b0030c303619b65a9dad1fee06c017f6828a2361206c78dade5b7ef7f7f3c4810a029f496c2a1a48e6c929156384a88edcb84e0
Static task
static1
Behavioral task
behavioral1
Sample
071e5d531e107b62f71a8854fb446230a73d0ce115be2912cbf505b0e450428b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
071e5d531e107b62f71a8854fb446230a73d0ce115be2912cbf505b0e450428b.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
darkcomet
Update
sosomelaine.ddns.net:1604
DC_MUTEX-8YW07F7
-
gencode
yNpsss59r5Df
-
install
false
-
offline_keylogger
true
-
password
amiga1200
-
persistence
false
Targets
-
-
Target
071e5d531e107b62f71a8854fb446230a73d0ce115be2912cbf505b0e450428b
-
Size
956KB
-
MD5
2a4e14eb3b0c1d04ecd67caa1696a6d0
-
SHA1
c7eacf73384cda71c8b0000fadfba37601c71046
-
SHA256
071e5d531e107b62f71a8854fb446230a73d0ce115be2912cbf505b0e450428b
-
SHA512
26c0bdc3e9b0043ba9a266e18b0030c303619b65a9dad1fee06c017f6828a2361206c78dade5b7ef7f7f3c4810a029f496c2a1a48e6c929156384a88edcb84e0
Score10/10-
Modifies WinLogon for persistence
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-