darkcomet

General

Target

4a485db03e2ee5ab14422d0617c17c6f4b04e4162e32dd9e09e32ddf8d45e6ae
Size

1.2MB
Sample

221126-clzenaea22
MD5

ad4e2774b2931257963ef9412ee8c859
SHA1

ded268e93c4e856f32bf7d9ae91530063a5fb35a
SHA256

4a485db03e2ee5ab14422d0617c17c6f4b04e4162e32dd9e09e32ddf8d45e6ae
SHA512

49f0e9477dccb7eba0079da7a969e97960ff6c88558fee33060be9fd2258589c6ed38f2ce0a08a99a10d8d1a804f6d0d90d748da68607cf855a979cef9536ca4
SSDEEP

24576:IhkL1xAjyblhDSrXx7Y0OryiCzQ7+DqKt1ihZl+UGWImbvZrDBS:wkL1eybl1Sr16rylzE6qKfihr+UGWImb

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

SA-MP Players

C2

xp.noip.me:1604

xp1.noip.me:1604

xp2.noip.me:1604

xp3.noip.me:1604

xp4.noip.me:1604

xp5.noip.me:1604

xp.noip.me:1605

xp1.noip.me:1605

xp2.noip.me:1605

xp3.noip.me:1605

xp4.noip.me:1605

xp5.noip.me:1605

Mutex

DC_MUTEX-QF340FQ

Attributes

InstallPath
system\update.exe
gencode
42zcgVwM0zh1
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Targets

- Target
  
  4a485db03e2ee5ab14422d0617c17c6f4b04e4162e32dd9e09e32ddf8d45e6ae
- Size
  
  1.2MB
- MD5
  
  ad4e2774b2931257963ef9412ee8c859
- SHA1
  
  ded268e93c4e856f32bf7d9ae91530063a5fb35a
- SHA256
  
  4a485db03e2ee5ab14422d0617c17c6f4b04e4162e32dd9e09e32ddf8d45e6ae
- SHA512
  
  49f0e9477dccb7eba0079da7a969e97960ff6c88558fee33060be9fd2258589c6ed38f2ce0a08a99a10d8d1a804f6d0d90d748da68607cf855a979cef9536ca4
- SSDEEP
  
  24576:IhkL1xAjyblhDSrXx7Y0OryiCzQ7+DqKt1ihZl+UGWImbvZrDBS:wkL1eybl1Sr16rylzE6qKfihr+UGWImb
Score

10^/10

darkcomet sa-mp players collection persistence rat spyware stealer trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2