Overview

overview

10

Static

static

aa5e6ad5e6...d9.exe

windows7-x64

10

aa5e6ad5e6...d9.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa5e6ad5e69f11766d24586fd67c0ff88169c75314607b7072bff239d74c2dd9

  • Size

    610KB

  • Sample

    221123-qpl6dshe3z

  • MD5

    54faf0f26546176482fe0e169246f9ae

  • SHA1

    50349a8aa03861501b3f4c654d4ef5e2595a9c2c

  • SHA256

    aa5e6ad5e69f11766d24586fd67c0ff88169c75314607b7072bff239d74c2dd9

  • SHA512

    aa8fd909f397a411078509e6eb6cea743373979a1ab6bd3f43a0dcfb04633f39e481a54d27da83260692409de75a484180377471c252569f457db32504cd3ff4

  • SSDEEP

    12288:wlU4xmr7+rY8SJNVtoAsGQ651D9Uymb3/DyYWqVpV+T/uJ:SU4xmf4VSbtaQ51KyIvBWqC/u

Score
10/10
darkcometfuckpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

FUCK

C2

uche.ddns.net:1604

Mutex

DC_MUTEX-WV2EB2L

Attributes
  • InstallPath

    C:\Program Files\CCleaner\CCleaner-resident.exe

  • gencode

    llCl02JUQDqQ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    CCleaner Resident Cleaner Service

Targets

    • Target

      aa5e6ad5e69f11766d24586fd67c0ff88169c75314607b7072bff239d74c2dd9

    • Size

      610KB

    • MD5

      54faf0f26546176482fe0e169246f9ae

    • SHA1

      50349a8aa03861501b3f4c654d4ef5e2595a9c2c

    • SHA256

      aa5e6ad5e69f11766d24586fd67c0ff88169c75314607b7072bff239d74c2dd9

    • SHA512

      aa8fd909f397a411078509e6eb6cea743373979a1ab6bd3f43a0dcfb04633f39e481a54d27da83260692409de75a484180377471c252569f457db32504cd3ff4

    • SSDEEP

      12288:wlU4xmr7+rY8SJNVtoAsGQ651D9Uymb3/DyYWqVpV+T/uJ:SU4xmf4VSbtaQ51KyIvBWqC/u

    Score
    10/10
    darkcometfuckpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks