General

  • Target

    557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a

  • Size

    540KB

  • Sample

    220725-ta9vpachg3

  • MD5

    c3edae9a4c8911ab76987f8c0a251603

  • SHA1

    bb69324baa60a51fce26e820676e4d5778db2f6f

  • SHA256

    557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a

  • SHA512

    3e79a9b6c3506622ce0b3f5ae02d86bca1ba878057bf4d7fe617cd69d7be1629e959e7f542d52c89bea8327599d9fe09c4c836e3ee97274658ebf40e3747c525

Malware Config

Targets

    • Target

      557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a

    • Size

      540KB

    • MD5

      c3edae9a4c8911ab76987f8c0a251603

    • SHA1

      bb69324baa60a51fce26e820676e4d5778db2f6f

    • SHA256

      557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a

    • SHA512

      3e79a9b6c3506622ce0b3f5ae02d86bca1ba878057bf4d7fe617cd69d7be1629e959e7f542d52c89bea8327599d9fe09c4c836e3ee97274658ebf40e3747c525

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Tasks