Overview

overview

10

Static

static

URLScan

urlscan

https://github.com

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://github.com
  • Sample221105-tm8s6aaggj
Score
10/10
blacknetdarkcometbotguest16persistencerattrojanupx

Malware Config

Extracted

Family

  • blacknet

Version

  • v3.6.0 Public

Botnet

  • Bot

C2

  • http://f0483357.xsph.ru/

Mutex

  • BN[PHfunXGI-6235724]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    jusched.exe

  • splitter

    |BN|

  • start_name

    a5b002eacf54590ec8401ff6d3f920ee

  • startup

    true

  • usb_spread

    true

Extracted

Family

  • darkcomet

Botnet

  • Guest16

C2

  • gameservice.ddns.net:4320

Mutex

  • DC_MUTEX-WBUNVXD

Attributes
  • InstallPath

    AudioDriver\taskhost.exe

  • gencode

    EWSsWwgyJrUD

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    AudioDriver

Targets

    • Target
      https://github.com
    Score
    10/10
    blacknetdarkcometbotguest16persistencerattrojanupx

    • BlackNET

      BlackNET is an open source remote access tool written in VB.NET.

      trojanblacknet

    • BlackNET payload

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks