Overview

overview

10

Static

static

10

f1232a3ce1...49.exe

windows7_x64

10

f1232a3ce1...49.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1232a3ce1b7fb19e7c5d24c85dc422ff3114dd74bc40d4095c31f2c55f51949

  • Size

    756KB

  • Sample

    220520-3tzcqshee3

  • MD5

    6167ef56e2d65f200e34f98edd16476c

  • SHA1

    be92e11e579604770fd3c7bbff2eb54872267299

  • SHA256

    f1232a3ce1b7fb19e7c5d24c85dc422ff3114dd74bc40d4095c31f2c55f51949

  • SHA512

    fc1bf9224c804fb01dc2e5c8dc9a1a221a6982f90f9179e234ade790fad0f1a4f9ea4233d627bd6f71efae7d829182071458542326b440b9e758d349ce27bfdd

Score
10/10
darkcometguest16evasionrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

zozorf.hopto.org:1604

Mutex

DC_MUTEX-XNRMK5M

Attributes
  • gencode

    gFFxV3kBcDyT

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      f1232a3ce1b7fb19e7c5d24c85dc422ff3114dd74bc40d4095c31f2c55f51949

    • Size

      756KB

    • MD5

      6167ef56e2d65f200e34f98edd16476c

    • SHA1

      be92e11e579604770fd3c7bbff2eb54872267299

    • SHA256

      f1232a3ce1b7fb19e7c5d24c85dc422ff3114dd74bc40d4095c31f2c55f51949

    • SHA512

      fc1bf9224c804fb01dc2e5c8dc9a1a221a6982f90f9179e234ade790fad0f1a4f9ea4233d627bd6f71efae7d829182071458542326b440b9e758d349ce27bfdd

    Score
    10/10
    darkcometevasionrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Disables Task Manager via registry modification

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks