General
-
Target
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349
-
Size
381KB
-
Sample
220731-jm21hagahl
-
MD5
48d1ef130b75aac8d5e6869d895b2ce8
-
SHA1
824b9c87c189f487f3a77a805cb1a20d3df03de3
-
SHA256
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349
-
SHA512
5bb039172ab860556ba0dfb7c19bb093c1ba75db36038caf5939c5187548cb866fdd1707613d4116979980897ab071551329e4913aeba30c067777c4b43e1ee8
Static task
static1
Behavioral task
behavioral1
Sample
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
darkcomet
JDB
ogparm.no-ip.org:1604
DC_MUTEX-GE44X6V
-
gencode
HNF9l7VodZpQ
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349
-
Size
381KB
-
MD5
48d1ef130b75aac8d5e6869d895b2ce8
-
SHA1
824b9c87c189f487f3a77a805cb1a20d3df03de3
-
SHA256
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349
-
SHA512
5bb039172ab860556ba0dfb7c19bb093c1ba75db36038caf5939c5187548cb866fdd1707613d4116979980897ab071551329e4913aeba30c067777c4b43e1ee8
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-