General
-
Target
7a331f142c3c74238a2374fedc66facc502200443dabb3a9c1ae54e2e9593d59
-
Size
796KB
-
Sample
221125-qazsyaaa42
-
MD5
af2620c755ac61e4b6d284844fa15ff1
-
SHA1
5dbfbc8c4d09d291409344dd15845d895ead95a6
-
SHA256
7a331f142c3c74238a2374fedc66facc502200443dabb3a9c1ae54e2e9593d59
-
SHA512
a8d16fa721ee745c3681c3e4d2ce9f5e7461543e539db6eb6158e90d8e647c1764f79f8a81e0219bd7aedf54a3d43b342871b3bb8c38aee98f0540ae5455fe4d
-
SSDEEP
12288:4rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h09HFJ4:41xuVVjfFoynPaVBUR8f+kN10EBOs
Behavioral task
behavioral1
Sample
7a331f142c3c74238a2374fedc66facc502200443dabb3a9c1ae54e2e9593d59.exe
Resource
win7-20220901-en
Malware Config
Extracted
darkcomet
Fuck
delhack.ddns.net:1604
127.0.0.1:1604
DC_MUTEX-9NMAJ7B
-
gencode
Tsqjr1QcpGTU
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
7a331f142c3c74238a2374fedc66facc502200443dabb3a9c1ae54e2e9593d59
-
Size
796KB
-
MD5
af2620c755ac61e4b6d284844fa15ff1
-
SHA1
5dbfbc8c4d09d291409344dd15845d895ead95a6
-
SHA256
7a331f142c3c74238a2374fedc66facc502200443dabb3a9c1ae54e2e9593d59
-
SHA512
a8d16fa721ee745c3681c3e4d2ce9f5e7461543e539db6eb6158e90d8e647c1764f79f8a81e0219bd7aedf54a3d43b342871b3bb8c38aee98f0540ae5455fe4d
-
SSDEEP
12288:4rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h09HFJ4:41xuVVjfFoynPaVBUR8f+kN10EBOs
-
Detect Neshta payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-