Overview

overview

10

Static

static

10

DARKCOMET ...ty.exe

windows7-x64

1

DARKCOMET ...ty.exe

windows10-2004-x64

1

DARKCOMET ...at.exe

windows7-x64

10

DARKCOMET ...at.exe

windows10-2004-x64

10

DARKCOMET ...er.exe

windows7-x64

1

DARKCOMET ...er.exe

windows10-2004-x64

1

DARKCOMET ...e3.dll

windows7-x64

3

DARKCOMET ...e3.dll

windows10-2004-x64

3

DARKCOMET ...er.dll

windows7-x64

1

DARKCOMET ...er.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DARKCOMET 5.3.1 Fixed.rar

  • Size

    14.1MB

  • Sample

    220719-lpwydabbh5

  • MD5

    4c8d6ec1cc006e938161e9779dcf8a46

  • SHA1

    12ff4e8498e0c6d7de77193a541ed9f5ec759fae

  • SHA256

    c2187e67fa488c35774a01ad87eeed302ea8ac0553155cae33b044d34455882f

  • SHA512

    df40a006db2983d292273790954c8488c83c8c3161ff8f865d37a5827615a9ae0c50e58e4f1cdf31ff2b363a88a7e88dfa0788fd74030f9ee78e7d2b39ce1541

Score
10/10
asyncratdarkcometdefaultguest16evasionpersistencerattrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

susiahat24199a.ddns.net:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    JavaCrashHandle.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

sussysdfffdfff343.duckdns.org:1604

Mutex

DC_MUTEX-QH9A6P4

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    YBnxcFaotAui

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    JavaUpdater

Targets

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Celesty Binder/Celesty.exe

    • Size

      2.7MB

    • MD5

      c3009ee63bc661d9ea75eaeb256448ca

    • SHA1

      45eb01150756df432e25eed44d976442473356de

    • SHA256

      0bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352

    • SHA512

      96f5847fbeef95df1309e97a4bc3d786a5f5c19b87e804f12d88b4473a0b50291c40407a3d95a2d5d78031f03be76da47f1846a73c7802ddae46a38ac4634e67

    Score
    1/10
    behavioral1behavioral2

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/DarkCometRat.exe

    • Size

      12.1MB

    • MD5

      c8c39c4d8cdfa38169be4057a70e04f2

    • SHA1

      ceddeda4a89ad8c0fc1765511ef9da9696803f9f

    • SHA256

      62f21406a307e447db6f0c2d91c626d947544effd6f56800c5e2e1beea18375c

    • SHA512

      ab21a5273e481cce2173ea6ee5d450a28f5ab1411699500f62d2c4e1b35dd5fc825931a0cd8cca9da4e92f5e2e06784e3f14006e1d76b8e197baf02ff22f0a30

    Score
    10/10
    asyncratdarkcometdefaultguest16evasionpersistencerattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Async RAT payload

      rat

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Spoof extensions/Spoofer.exe

    • Size

      2.0MB

    • MD5

      894b256f41dc579a5b32828ed2f7e3db

    • SHA1

      06fa1a4dd30780e404c8f2e7a615fd54d6f2ae68

    • SHA256

      12dbd354b4cc073ea7f80cc0d74bd96118362e9c120df7800cf0f9e863569f98

    • SHA512

      bede5a2c6e87ac6d432903109cca97fcbf60fdba082ba137a04c6ca6490a548f20910b6560821816b76744235fa19f5fcbe256c1ad9b87c2c1b8b20e5c5ac409

    Score
    1/10
    behavioral5behavioral6

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/sqlite3.dll

    • Size

      510KB

    • MD5

      d3979db259f55d59b4edb327673c1905

    • SHA1

      0697e8f35b5951c61a3a632d74fd96843c941628

    • SHA256

      043e5570299c6099756c1809c5632eabeab95ed3c1a55c86843c0ec218940e5a

    • SHA512

      0b87c89aafd3e627c7d6bed0b833601fea1917a76a972061f32a2d9e4aa2e9e85b5e8a67cb330ca44aff17915d0fe2793798451a109d3f0b5014eed06b73bb45

    Score
    3/10
    behavioral7behavioral8

    • Target

      DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/userfixer.dll

    • Size

      2.2MB

    • MD5

      81598070e630b776a8f6953dd8206915

    • SHA1

      1e14345e73476c7b1b85cb30d904730b50f8b2c4

    • SHA256

      d169c3502a9e8ada5a994bcf06d3a1ba57142b0a47b4424d364305e64151e1c9

    • SHA512

      e1d7d3074f7e525053789518a0e685d722dbbcf5df67364cb3954a8a29af22cb09990343ed41772894ce174534abef71237a9ea5006dbd2e6e4c78ee7b5ebe22

    Score
    1/10
    behavioral9behavioral10

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

2
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks