Overview

overview

10

Static

static

10

d7d561cdef...7a.exe

windows7-x64

10

d7d561cdef...7a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d7d561cdef5634262f49cebbd1bca1a5dabd063bb2073cb52589f510a0370b7a

  • Size

    252KB

  • Sample

    221020-1qe4ksgbc8

  • MD5

    80ee1d2c1f89410dcc731a0bfbcf152f

  • SHA1

    3e1963010c9439a99a50963c71e6a5c270789bec

  • SHA256

    d7d561cdef5634262f49cebbd1bca1a5dabd063bb2073cb52589f510a0370b7a

  • SHA512

    4b3a1ce143b167905b615702b11b17a71f929e31a248410a55be061a1b46d4036713a25bc0355bffbeb6428a70290a01180883b11ccbcdbd7942e9f8abbeddb3

  • SSDEEP

    6144:6cNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQd:6cWkbgTYWnYnt/IDYhP8

Score
10/10
darkcometdspersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

DS

C2

safa-kach.no-ip.biz:1604

94.153.58.76:81
Mutex

DC_MUTEX-DB61LF1

Attributes
  • InstallPath

    MSDCSC\vk.exe

  • gencode

    JE7Mrb31ojWV

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      d7d561cdef5634262f49cebbd1bca1a5dabd063bb2073cb52589f510a0370b7a

    • Size

      252KB

    • MD5

      80ee1d2c1f89410dcc731a0bfbcf152f

    • SHA1

      3e1963010c9439a99a50963c71e6a5c270789bec

    • SHA256

      d7d561cdef5634262f49cebbd1bca1a5dabd063bb2073cb52589f510a0370b7a

    • SHA512

      4b3a1ce143b167905b615702b11b17a71f929e31a248410a55be061a1b46d4036713a25bc0355bffbeb6428a70290a01180883b11ccbcdbd7942e9f8abbeddb3

    • SSDEEP

      6144:6cNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQd:6cWkbgTYWnYnt/IDYhP8

    Score
    10/10
    darkcometdspersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks