Overview

overview

10

Static

static

aa3a195300...68.exe

windows7-x64

10

aa3a195300...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68

  • Size

    688KB

  • Sample

    221124-ehw68sah3w

  • MD5

    c373556332f48435c9ee85d7f7b59fa5

  • SHA1

    894e1ca1487ae6f5b56ca07aae1368f142157335

  • SHA256

    aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68

  • SHA512

    9ef0fa7179fc5fcff49d80a152b53d13bbe2c6d3b87f88056ddb5ea3fbec4c0c7c2520e14468fd2116967030258f24119e86b7cc53292b2feb00ce284576ab48

  • SSDEEP

    12288:eCp61Z0OYunIBU+KMSZWQmzHZEV81N68wUUl9G9TsjNk4AhveYp1:eCg1BIBU+6ZWQmzWlgSW4Ah7

Score
10/10
darkcometdc 5.1persistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

DC 5.1

C2

netspych.no-ip.biz:1604

Mutex

DC_MUTEX-X8NHXUZ

Attributes
  • gencode

    1tkzfnt8C2wn

  • install

    false

  • offline_keylogger

    true

  • password

    nsc2012

  • persistence

    false

Targets

    • Target

      aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68

    • Size

      688KB

    • MD5

      c373556332f48435c9ee85d7f7b59fa5

    • SHA1

      894e1ca1487ae6f5b56ca07aae1368f142157335

    • SHA256

      aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68

    • SHA512

      9ef0fa7179fc5fcff49d80a152b53d13bbe2c6d3b87f88056ddb5ea3fbec4c0c7c2520e14468fd2116967030258f24119e86b7cc53292b2feb00ce284576ab48

    • SSDEEP

      12288:eCp61Z0OYunIBU+KMSZWQmzHZEV81N68wUUl9G9TsjNk4AhveYp1:eCg1BIBU+6ZWQmzWlgSW4Ah7

    Score
    10/10
    darkcometdc 5.1persistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks