General
-
Target
5ef891b82e3bf3810d99ac3535d070c3b4615adfcac5d158a3b5b8ea369d9190
-
Size
658KB
-
Sample
221125-kgd7xshd4t
-
MD5
f7bf4b5a76924169cc5bf45cf23902b9
-
SHA1
3cbcd664a2b51eba71c9efe113e15515e9c900c1
-
SHA256
5ef891b82e3bf3810d99ac3535d070c3b4615adfcac5d158a3b5b8ea369d9190
-
SHA512
cdedf956f723bd20f723cb9892d684af18fef9a58eeb67939b04fdd96e18c216adef58a7ab22ab39a6b77d182eb8fdd1e63b936d980d3c5aa3e296661a88a222
-
SSDEEP
12288:C9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFQ:uiBIGkbxqEcjsWiDxguehC2Sr
Behavioral task
behavioral1
Sample
5ef891b82e3bf3810d99ac3535d070c3b4615adfcac5d158a3b5b8ea369d9190.exe
Resource
win7-20220901-en
Malware Config
Extracted
darkcomet
Guest16
192.168.2.196:1604
DC_MUTEX-1CRTNX9
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
gh7aHBKiofzL
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
5ef891b82e3bf3810d99ac3535d070c3b4615adfcac5d158a3b5b8ea369d9190
-
Size
658KB
-
MD5
f7bf4b5a76924169cc5bf45cf23902b9
-
SHA1
3cbcd664a2b51eba71c9efe113e15515e9c900c1
-
SHA256
5ef891b82e3bf3810d99ac3535d070c3b4615adfcac5d158a3b5b8ea369d9190
-
SHA512
cdedf956f723bd20f723cb9892d684af18fef9a58eeb67939b04fdd96e18c216adef58a7ab22ab39a6b77d182eb8fdd1e63b936d980d3c5aa3e296661a88a222
-
SSDEEP
12288:C9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFQ:uiBIGkbxqEcjsWiDxguehC2Sr
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-