Overview

overview

10

Static

static

10

0d8f4776b5...11.exe

windows7-x64

10

0d8f4776b5...11.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0d8f4776b54a1ef3cc3b286f1d81d0ebc9f98d6c35c80af831359cdb4caaa211

  • Size

    346KB

  • Sample

    221029-3scgkscbc9

  • MD5

    8480fcf7fe43afd9140bbb2ff05a8509

  • SHA1

    fe13046f6520ba7c03cfe6fae25f3b0d1f9ad9f6

  • SHA256

    0d8f4776b54a1ef3cc3b286f1d81d0ebc9f98d6c35c80af831359cdb4caaa211

  • SHA512

    c0b5193f8610e55cd0b0ae2c1f6c3c028f466c476c24e49b20706bd25fd5e05573a91003d6e5feee9fbfdb429ede0ecebdaf6f001c3ba96185bafb73d2e2699b

  • SSDEEP

    6144:SFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsqhXb:WR72EqluswR45JTnaEY2sXb

Score
10/10
darkcometevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      0d8f4776b54a1ef3cc3b286f1d81d0ebc9f98d6c35c80af831359cdb4caaa211

    • Size

      346KB

    • MD5

      8480fcf7fe43afd9140bbb2ff05a8509

    • SHA1

      fe13046f6520ba7c03cfe6fae25f3b0d1f9ad9f6

    • SHA256

      0d8f4776b54a1ef3cc3b286f1d81d0ebc9f98d6c35c80af831359cdb4caaa211

    • SHA512

      c0b5193f8610e55cd0b0ae2c1f6c3c028f466c476c24e49b20706bd25fd5e05573a91003d6e5feee9fbfdb429ede0ecebdaf6f001c3ba96185bafb73d2e2699b

    • SSDEEP

      6144:SFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsqhXb:WR72EqluswR45JTnaEY2sXb

    Score
    10/10
    darkcometevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks