General
-
Target
5b55e2dbac9d4cd6ac167d2901fc0757efe21ac0fc9d0f44aa45ed38d6df82be
-
Size
394KB
-
Sample
220802-agt82aagf3
-
MD5
56aa993a41a0cd5a8006d088d5283237
-
SHA1
8bc08024acc34a501a0cdbee4deab5fcb031de3b
-
SHA256
5b55e2dbac9d4cd6ac167d2901fc0757efe21ac0fc9d0f44aa45ed38d6df82be
-
SHA512
1428301912495253d03c03dbcae08ca97bb6f4ecfd10de0ea342af4115796450e494a6b2ed2662bd1e49dcf5d5c00e6f38d780a3fc16764fee226b9affef4673
Static task
static1
Behavioral task
behavioral1
Sample
5b55e2dbac9d4cd6ac167d2901fc0757efe21ac0fc9d0f44aa45ed38d6df82be.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5b55e2dbac9d4cd6ac167d2901fc0757efe21ac0fc9d0f44aa45ed38d6df82be.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
darkcomet
JDB
ogparm.no-ip.org:1604
DC_MUTEX-1QSZ3S8
-
gencode
ZRkFME9MDXp6
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
5b55e2dbac9d4cd6ac167d2901fc0757efe21ac0fc9d0f44aa45ed38d6df82be
-
Size
394KB
-
MD5
56aa993a41a0cd5a8006d088d5283237
-
SHA1
8bc08024acc34a501a0cdbee4deab5fcb031de3b
-
SHA256
5b55e2dbac9d4cd6ac167d2901fc0757efe21ac0fc9d0f44aa45ed38d6df82be
-
SHA512
1428301912495253d03c03dbcae08ca97bb6f4ecfd10de0ea342af4115796450e494a6b2ed2662bd1e49dcf5d5c00e6f38d780a3fc16764fee226b9affef4673
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-