General
-
Target
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
-
Size
658KB
-
Sample
221124-ehmykaff75
-
MD5
41140b64da737d999d6b06763b8de287
-
SHA1
ec5ebd2a21e81961b97f8ddbde0ac5b28b452f49
-
SHA256
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
-
SHA512
dd880450a8b477b24801dd8e1b067b1b7a0604367ac8c861aad86a89270507ee5dfc989f382ca633908e41949e5561860e5991f69ba2cab356915df095f84c50
-
SSDEEP
12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ht:eZ1xuVVjfFoynPaVBUR8f+kN10EBr
Behavioral task
behavioral1
Sample
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
darkcomet
asdf
noname1231.no-ip.org:1604
DCMIN_MUTEX-2XGL6JH
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
hDbhnXrnGv4R
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Targets
-
-
Target
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
-
Size
658KB
-
MD5
41140b64da737d999d6b06763b8de287
-
SHA1
ec5ebd2a21e81961b97f8ddbde0ac5b28b452f49
-
SHA256
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
-
SHA512
dd880450a8b477b24801dd8e1b067b1b7a0604367ac8c861aad86a89270507ee5dfc989f382ca633908e41949e5561860e5991f69ba2cab356915df095f84c50
-
SSDEEP
12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ht:eZ1xuVVjfFoynPaVBUR8f+kN10EBr
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-