General
-
Target
fa9988a4e00609168271a26b6e0188c5b9d8a31e710b35b0bdff239c5548d0c0
-
Size
1.2MB
-
Sample
221126-cleegsdh73
-
MD5
9f07da1ac4d5b6ee1ca3f1f7d04c569a
-
SHA1
2fe8be8160ee37b1c32e0efcdf80fbb347c5ded4
-
SHA256
fa9988a4e00609168271a26b6e0188c5b9d8a31e710b35b0bdff239c5548d0c0
-
SHA512
28be9e6f3906c890a88fad52157204aa7b8b767f62c6be6bb648e00df699e81d46c91cf9b6aaf996b5ec87254232847bf19be196f0a31416bbb1c4cbdf3c06f4
-
SSDEEP
24576:cKiRzC0BBDuGdH/m3rY0Mfu5GO52FBiMjqcL0XRCzgfkxMYr+F:9iRnBJuG9+MIGOIFBHOcL0XRCzgfW+
Behavioral task
behavioral1
Sample
fa9988a4e00609168271a26b6e0188c5b9d8a31e710b35b0bdff239c5548d0c0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fa9988a4e00609168271a26b6e0188c5b9d8a31e710b35b0bdff239c5548d0c0.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
darkcomet
SA-MP
xp.noip.me:1604
xp1.noip.me:1604
xp2.noip.me:1604
xp3.noip.me:1604
xp4.noip.me:1604
xp5.noip.me:1604
xp.noip.me:1605
xp1.noip.me:1605
xp2.noip.me:1605
xp3.noip.me:1605
xp4.noip.me:1605
xp5.noip.me:1605
DC_MUTEX-R50RWXA
-
InstallPath
Ready\update.exe
-
gencode
3cwneU8zJQtS
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
fa9988a4e00609168271a26b6e0188c5b9d8a31e710b35b0bdff239c5548d0c0
-
Size
1.2MB
-
MD5
9f07da1ac4d5b6ee1ca3f1f7d04c569a
-
SHA1
2fe8be8160ee37b1c32e0efcdf80fbb347c5ded4
-
SHA256
fa9988a4e00609168271a26b6e0188c5b9d8a31e710b35b0bdff239c5548d0c0
-
SHA512
28be9e6f3906c890a88fad52157204aa7b8b767f62c6be6bb648e00df699e81d46c91cf9b6aaf996b5ec87254232847bf19be196f0a31416bbb1c4cbdf3c06f4
-
SSDEEP
24576:cKiRzC0BBDuGdH/m3rY0Mfu5GO52FBiMjqcL0XRCzgfkxMYr+F:9iRnBJuG9+MIGOIFBHOcL0XRCzgfW+
-
Modifies WinLogon for persistence
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-