darkcomet

General

Target

443051914672ecbcdbddf897e2db78f90008ad49e9d6073af5978f2f8038a957
Size

755KB
Sample

221126-dflr2sga56
MD5

4331bdb8c7fec28e046f758e1446b2d9
SHA1

96776356f513d9a29ebf499c71d77cfdd0cae3fa
SHA256

443051914672ecbcdbddf897e2db78f90008ad49e9d6073af5978f2f8038a957
SHA512

39675a8dde4078d32f69125e8a8b87d562c24fc8189e993c6b892b9d9c8bf80b57bba5f9f6d54aa41e794069d98b274563adff8f03b9119c8f543eb8f41c2515
SSDEEP

12288:hcvpGGNuioj9UHpnsfTBlaJKJYKbrIFuGW6nEWRyLE2Rx:KvECU9UHpnsfdda+1GW6zRyIE

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

85.93.52.232:1604

Mutex

DC_MUTEX-BAB6N9P

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
1RAPuVGkWQTX
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Targets

- Target
  
  443051914672ecbcdbddf897e2db78f90008ad49e9d6073af5978f2f8038a957
- Size
  
  755KB
- MD5
  
  4331bdb8c7fec28e046f758e1446b2d9
- SHA1
  
  96776356f513d9a29ebf499c71d77cfdd0cae3fa
- SHA256
  
  443051914672ecbcdbddf897e2db78f90008ad49e9d6073af5978f2f8038a957
- SHA512
  
  39675a8dde4078d32f69125e8a8b87d562c24fc8189e993c6b892b9d9c8bf80b57bba5f9f6d54aa41e794069d98b274563adff8f03b9119c8f543eb8f41c2515
- SSDEEP
  
  12288:hcvpGGNuioj9UHpnsfTBlaJKJYKbrIFuGW6nEWRyLE2Rx:KvECU9UHpnsfdda+1GW6zRyIE
Score

10^/10

darkcomet neshta guest16 evasion persistence rat spyware stealer trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Detect Neshta payload
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies system executable filetype association
  persistence
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2