Overview

overview

10

Static

static

10

38fe7ad463...8b.exe

windows7-x64

10

38fe7ad463...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38fe7ad463b1d9b9ac351df7e7669c31ec0a456aa941c3207c7cf5c0a6e3ad8b

  • Size

    283KB

  • Sample

    220725-ajhm1sega5

  • MD5

    a621055f753ae69983b149c494e24929

  • SHA1

    c84337eb41ff9f6f9c2a999292db7e3066a379e3

  • SHA256

    38fe7ad463b1d9b9ac351df7e7669c31ec0a456aa941c3207c7cf5c0a6e3ad8b

  • SHA512

    5d1be5fb16549c3b120c6c7a20e3086c764ee9bdf4faad0d22875057193bcb1aded84147b32e00e8df95fcf3e2c0e8e2948a1bfaaef0aef4408f38172d400de8

Score
10/10
darkcometguest16evasionrattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

IP: 95.153.133.216:1604

Mutex

DC_MUTEX-0P8M51K

Attributes
  • gencode

    TGWq7XBoqMps

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      38fe7ad463b1d9b9ac351df7e7669c31ec0a456aa941c3207c7cf5c0a6e3ad8b

    • Size

      283KB

    • MD5

      a621055f753ae69983b149c494e24929

    • SHA1

      c84337eb41ff9f6f9c2a999292db7e3066a379e3

    • SHA256

      38fe7ad463b1d9b9ac351df7e7669c31ec0a456aa941c3207c7cf5c0a6e3ad8b

    • SHA512

      5d1be5fb16549c3b120c6c7a20e3086c764ee9bdf4faad0d22875057193bcb1aded84147b32e00e8df95fcf3e2c0e8e2948a1bfaaef0aef4408f38172d400de8

    Score
    10/10
    darkcometguest16evasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Drops file in Drivers directory

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

2
T1089

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks