Overview

overview

10

Static

static

3365215f2c...89.exe

windows7-x64

10

3365215f2c...89.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3365215f2c625fd51504e0e51d3aa5c2452b72089e0981dad1025569e868a889

  • Size

    3.1MB

  • Sample

    221003-b781jscfgr

  • MD5

    6b84b35b9b5f1f1b43c4499457adda4b

  • SHA1

    cabe5899b9bc1dfcc9e122692b3ec81bd405a92a

  • SHA256

    3365215f2c625fd51504e0e51d3aa5c2452b72089e0981dad1025569e868a889

  • SHA512

    153393e95357b0bde6f18f5fb92df38123c127b54c4f4eea6cfc76e7e6bbcf563a5cdb9dc8e798891dbb95ed22c3c9dea726f18452c77b246ff9bfd7220e9064

  • SSDEEP

    49152:Xr2KxuLaFzf5zmce0Z9jpVyd4fdBOdygokagOJFwtPLxx8MiGrlZ0iiQF5JxRQcs:b2AJFhmQZ9FVyd6+dytRJF2PyG3r3Q1

Score
10/10
darkcometvirpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

VIR

C2

msdsl.sytes.net:1605

Mutex

TEXBWH3YU5

Attributes
  • gencode

    lHZkfrNRLD6o

  • install

    false

  • offline_keylogger

    true

  • password

    darkcomet

  • persistence

    false

Targets

    • Target

      3365215f2c625fd51504e0e51d3aa5c2452b72089e0981dad1025569e868a889

    • Size

      3.1MB

    • MD5

      6b84b35b9b5f1f1b43c4499457adda4b

    • SHA1

      cabe5899b9bc1dfcc9e122692b3ec81bd405a92a

    • SHA256

      3365215f2c625fd51504e0e51d3aa5c2452b72089e0981dad1025569e868a889

    • SHA512

      153393e95357b0bde6f18f5fb92df38123c127b54c4f4eea6cfc76e7e6bbcf563a5cdb9dc8e798891dbb95ed22c3c9dea726f18452c77b246ff9bfd7220e9064

    • SSDEEP

      49152:Xr2KxuLaFzf5zmce0Z9jpVyd4fdBOdygokagOJFwtPLxx8MiGrlZ0iiQF5JxRQcs:b2AJFhmQZ9FVyd6+dytRJF2PyG3r3Q1

    Score
    10/10
    darkcometvirpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks