Overview

overview

10

Static

static

10

383fdf3e82...8c.exe

windows7-x64

10

383fdf3e82...8c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    383fdf3e8222919c1011273fb3984ed541c620f4248bb54990a8be2a12486d8c

  • Size

    648KB

  • Sample

    221123-3r2p3sgd2v

  • MD5

    1af58b00e3c19a6e3322dc0a0ffa1986

  • SHA1

    d1a72105983af7292db5b13859edd5c82490c5a9

  • SHA256

    383fdf3e8222919c1011273fb3984ed541c620f4248bb54990a8be2a12486d8c

  • SHA512

    ef8b8e64e54cfec7eec3d23b7fc5a7718832c462a35a0ae065d70b1aa5f052e0c9f28259ebc9fcb76bce905609479cf08e4e018c061260ae788f55fd78f754cf

  • SSDEEP

    12288:w6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhQ:VAmBpVKHu0Mu9Xo20VGLVP5Q

Score
10/10
darkcometevasionpersistencerattrojan

Malware Config

Targets

    • Target

      383fdf3e8222919c1011273fb3984ed541c620f4248bb54990a8be2a12486d8c

    • Size

      648KB

    • MD5

      1af58b00e3c19a6e3322dc0a0ffa1986

    • SHA1

      d1a72105983af7292db5b13859edd5c82490c5a9

    • SHA256

      383fdf3e8222919c1011273fb3984ed541c620f4248bb54990a8be2a12486d8c

    • SHA512

      ef8b8e64e54cfec7eec3d23b7fc5a7718832c462a35a0ae065d70b1aa5f052e0c9f28259ebc9fcb76bce905609479cf08e4e018c061260ae788f55fd78f754cf

    • SSDEEP

      12288:w6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhQ:VAmBpVKHu0Mu9Xo20VGLVP5Q

    Score
    10/10
    darkcometevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks