Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    09f78205549095fa583201ea63d81cd5c8f2a7c65ff620c8dd251849d7093565

  • Size

    708KB

  • Sample

    221019-3ml4tsddck

  • MD5

    a136f80eebdb57bdebe406825c86d750

  • SHA1

    83540c8b382854b67530efdca9bf46d649a8dc36

  • SHA256

    09f78205549095fa583201ea63d81cd5c8f2a7c65ff620c8dd251849d7093565

  • SHA512

    0cb287b3b5b7a7e086510d8d134fb8d497174f2f542a59e91cd63d77c6220b5be189774f8e1cbb5b7e7dc3a3635911182a435da263ee6910f1933a3791715589

  • SSDEEP

    12288:wSS2Zdio6T+hWjxyNRh4gGJzEW0YQmvelqx2RgZM1/vXkHiBl3M:w72ZdoTKWj8NR+gGaW0YRv9x2R3v0CB

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

mafiausax.no-ip.org:1333

Mutex

DC_MUTEX-0W6K1RW

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    KaiNiaKuj5AE

  • install

    true

  • offline_keylogger

    true

  • password

    0123456789

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      09f78205549095fa583201ea63d81cd5c8f2a7c65ff620c8dd251849d7093565

    • Size

      708KB

    • MD5

      a136f80eebdb57bdebe406825c86d750

    • SHA1

      83540c8b382854b67530efdca9bf46d649a8dc36

    • SHA256

      09f78205549095fa583201ea63d81cd5c8f2a7c65ff620c8dd251849d7093565

    • SHA512

      0cb287b3b5b7a7e086510d8d134fb8d497174f2f542a59e91cd63d77c6220b5be189774f8e1cbb5b7e7dc3a3635911182a435da263ee6910f1933a3791715589

    • SSDEEP

      12288:wSS2Zdio6T+hWjxyNRh4gGJzEW0YQmvelqx2RgZM1/vXkHiBl3M:w72ZdoTKWj8NR+gGaW0YRv9x2R3v0CB

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks