Overview

overview

10

Static

static

31fbb03d31...5f.exe

windows7-x64

10

31fbb03d31...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31fbb03d31e7795ab6fa95dd2045876f516e4f6043c2d5209b56e2bd8483825f

  • Size

    1.4MB

  • Sample

    221002-k288sshhek

  • MD5

    6c4fd4892b2f680e75cd06a2b7c8a345

  • SHA1

    9b7b0ae22cfd2d85aa27a43d65570c09a55dc6ff

  • SHA256

    31fbb03d31e7795ab6fa95dd2045876f516e4f6043c2d5209b56e2bd8483825f

  • SHA512

    51705859290dd981ce533cd7c21895e18b0ebef7995e0c3a8edb331e5350796d0c95d187cf50085e88e9f31d323f2582747b13e7793450b266c6cd1600a5a381

  • SSDEEP

    24576:ZhqU/8O55m4/bK4XuNGLBGAxBFuRm5zxlpUey0gf58Cnu/+KI5fwHko1tK/FIIbM:ZhqU/T55m4+Lams5ILDskorKWN

Score
10/10
darkcomethfpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

HF

C2

cyber-dos.no-ip.org:1337

Mutex

DC_MUTEX-12KVRY9

Attributes
  • gencode

    THybCZwopUiG

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      31fbb03d31e7795ab6fa95dd2045876f516e4f6043c2d5209b56e2bd8483825f

    • Size

      1.4MB

    • MD5

      6c4fd4892b2f680e75cd06a2b7c8a345

    • SHA1

      9b7b0ae22cfd2d85aa27a43d65570c09a55dc6ff

    • SHA256

      31fbb03d31e7795ab6fa95dd2045876f516e4f6043c2d5209b56e2bd8483825f

    • SHA512

      51705859290dd981ce533cd7c21895e18b0ebef7995e0c3a8edb331e5350796d0c95d187cf50085e88e9f31d323f2582747b13e7793450b266c6cd1600a5a381

    • SSDEEP

      24576:ZhqU/8O55m4/bK4XuNGLBGAxBFuRm5zxlpUey0gf58Cnu/+KI5fwHko1tK/FIIbM:ZhqU/T55m4+Lams5ILDskorKWN

    Score
    10/10
    darkcomethfpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks