General
-
Target
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
-
Size
756KB
-
Sample
220520-2jbcgsfde4
-
MD5
86498e5016ff2cb3f0a84f0e03612858
-
SHA1
4f35692e54c22730b0601a9c3048c7baadf57939
-
SHA256
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
-
SHA512
fbe48fb5e8d351a80363dc0de57d970cabed1228e20560df4cd02d75c42b219a70d46057af9c581fcb364751cca315d866b8fcfe46630be72c49e8aecf46453f
Behavioral task
behavioral1
Sample
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
TacticG
192.168.1.113:1604
DC_MUTEX-H293GMA
-
InstallPath
windows\RealBoss.exe
-
gencode
kYG8AAeQRp04
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
RealBoss.exe
Targets
-
-
Target
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
-
Size
756KB
-
MD5
86498e5016ff2cb3f0a84f0e03612858
-
SHA1
4f35692e54c22730b0601a9c3048c7baadf57939
-
SHA256
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
-
SHA512
fbe48fb5e8d351a80363dc0de57d970cabed1228e20560df4cd02d75c42b219a70d46057af9c581fcb364751cca315d866b8fcfe46630be72c49e8aecf46453f
-
Modifies WinLogon for persistence
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-