General
-
Target
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8
-
Size
690KB
-
Sample
220520-3pgl5acbfj
-
MD5
c0261de6f8482d655c503f1010dc8896
-
SHA1
093b6680099771887c91b9b7e8bd1bb9d0900cff
-
SHA256
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8
-
SHA512
1cf854af7421f4ee673eb31de2ddd4102b58abc835a381ff4628e6bb50d313342a7656e77884eca0626d22afaaa643a32d8a0d5de1d88c16aff75bd75fcdee19
Behavioral task
behavioral1
Sample
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe
Resource
win7-20220414-en
Malware Config
Extracted
darkcomet
Guest16
12345poebalylovi.ddns.net:1604
12345poebalylovi.ddns.net:27015
DC_MUTEX-GTTG3R1
-
gencode
cr291lnLucP6
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8
-
Size
690KB
-
MD5
c0261de6f8482d655c503f1010dc8896
-
SHA1
093b6680099771887c91b9b7e8bd1bb9d0900cff
-
SHA256
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8
-
SHA512
1cf854af7421f4ee673eb31de2ddd4102b58abc835a381ff4628e6bb50d313342a7656e77884eca0626d22afaaa643a32d8a0d5de1d88c16aff75bd75fcdee19
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-