General
-
Target
96fa2d60fb2e27d71fd21d7bebb2cdaf0f650ed3683ae829d6b17a19c1ec2171
-
Size
436KB
-
Sample
221001-3ncxjscbd9
-
MD5
68921ea14e8cdfc8f8775263632802a0
-
SHA1
12b5d5437cf20e1eba91826bec9411b0c69098ff
-
SHA256
96fa2d60fb2e27d71fd21d7bebb2cdaf0f650ed3683ae829d6b17a19c1ec2171
-
SHA512
8161a10dc45457c5050623e10d2169725607285b480e42c9bb5c15110289991bdb28ec9cad86e42f95d3db3a1d21dfdc08d525e9258f4183482cbf9fe130f61d
-
SSDEEP
12288:GcW7KEZlPzCy37oStLov/v6AYYYYYYYYYYYRYYYYYYYYYYL:KKiRzC0hsDYYYYYYYYYYYRYYYYYYYYYY
Behavioral task
behavioral1
Sample
96fa2d60fb2e27d71fd21d7bebb2cdaf0f650ed3683ae829d6b17a19c1ec2171.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
Guest16
cybergatenou4r.zapto.org:1604
DC_MUTEX-Z78F0FY
-
InstallPath
explorer\update.exe
-
gencode
iggsNm91khSs
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
update
Targets
-
-
Target
96fa2d60fb2e27d71fd21d7bebb2cdaf0f650ed3683ae829d6b17a19c1ec2171
-
Size
436KB
-
MD5
68921ea14e8cdfc8f8775263632802a0
-
SHA1
12b5d5437cf20e1eba91826bec9411b0c69098ff
-
SHA256
96fa2d60fb2e27d71fd21d7bebb2cdaf0f650ed3683ae829d6b17a19c1ec2171
-
SHA512
8161a10dc45457c5050623e10d2169725607285b480e42c9bb5c15110289991bdb28ec9cad86e42f95d3db3a1d21dfdc08d525e9258f4183482cbf9fe130f61d
-
SSDEEP
12288:GcW7KEZlPzCy37oStLov/v6AYYYYYYYYYYYRYYYYYYYYYYL:KKiRzC0hsDYYYYYYYYYYYRYYYYYYYYYY
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-