darkcomet

General

Target

cf7527269babac23d920bf76f09591e0c804f084a8fa4089c0dae39003d01fab
Size

1.5MB
Sample

221126-cgdbmadf48
MD5

5ff648544b2ccc4b2c1f6b5bbf2de4a2
SHA1

5b39638aee007fd8b6cc65562c72589ff5ac48e5
SHA256

cf7527269babac23d920bf76f09591e0c804f084a8fa4089c0dae39003d01fab
SHA512

3aa87cb03be735f294e9d6a8ca05c36c4631576b38fb75d5c96445cd5e61cd2ee56c2fbea504c1c3c4ea35a01775f9c4d3022b5df2ef0cda492b24cd2ab6a8dc
SSDEEP

24576:8Z1xuVVjfFoynPaVBUR8f+kN10EBk6BdVS7+knFxfCqrX6WyfOHcPpkmbSt5hezo:sQDgok30ybBaFxfC3WSOHcPumb/o

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

SA-MP Players

C2

xp.noip.me:1604

xp1.noip.me:1604

xp2.noip.me:1604

xp3.noip.me:1604

xp4.noip.me:1604

xp5.noip.me:1604

xp.noip.me:1605

xp1.noip.me:1605

xp2.noip.me:1605

xp3.noip.me:1605

xp4.noip.me:1605

xp5.noip.me:1605

Mutex

DC_MUTEX-QF340FQ

Attributes

InstallPath
system\update.exe
gencode
42zcgVwM0zh1
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Targets

- Target
  
  cf7527269babac23d920bf76f09591e0c804f084a8fa4089c0dae39003d01fab
- Size
  
  1.5MB
- MD5
  
  5ff648544b2ccc4b2c1f6b5bbf2de4a2
- SHA1
  
  5b39638aee007fd8b6cc65562c72589ff5ac48e5
- SHA256
  
  cf7527269babac23d920bf76f09591e0c804f084a8fa4089c0dae39003d01fab
- SHA512
  
  3aa87cb03be735f294e9d6a8ca05c36c4631576b38fb75d5c96445cd5e61cd2ee56c2fbea504c1c3c4ea35a01775f9c4d3022b5df2ef0cda492b24cd2ab6a8dc
- SSDEEP
  
  24576:8Z1xuVVjfFoynPaVBUR8f+kN10EBk6BdVS7+knFxfCqrX6WyfOHcPpkmbSt5hezo:sQDgok30ybBaFxfC3WSOHcPumb/o
Score

10^/10

darkcomet collection persistence rat spyware stealer trojan upx sa-mp players
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2