Overview

overview

10

Static

static

eea615efc2...d2.exe

windows7-x64

10

eea615efc2...d2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eea615efc27f4dbaa20f493226caf399a4f5994fd1493f03ac75deffa81954d2

  • Size

    675KB

  • Sample

    221126-kvfmxaae2z

  • MD5

    0b6ddda7ba995c36b25bf5f562b4104f

  • SHA1

    fd103c9f0ac2f8462f9c8f24bcfe1fca22eb691d

  • SHA256

    eea615efc27f4dbaa20f493226caf399a4f5994fd1493f03ac75deffa81954d2

  • SHA512

    c30e7ec9283f1917b05fdbf952d145837ad407b3bdc5431d78cb6a0f70af3a0192f0373c4fc3aefb7cae9766b0813ba802241a4a51f4b7ae7dbffd42738daab4

  • SSDEEP

    12288:iat0EAH49n8BGe60O+/CRcDrNnyWP28xRqcrINVeAGXHbH6zAv2P5up+Jit:Nt24Je6BeC2yXKR0reNXHmzA0+

Score
10/10
darkcometæåðòâàevasionpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Æåðòâà

C2

znz.ddns.net:25565

Mutex

DC_MUTEX-Q6D7RHQ

Attributes
  • InstallPath

    sv�h�st.exe

  • gencode

    ijcTThqReeek

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      eea615efc27f4dbaa20f493226caf399a4f5994fd1493f03ac75deffa81954d2

    • Size

      675KB

    • MD5

      0b6ddda7ba995c36b25bf5f562b4104f

    • SHA1

      fd103c9f0ac2f8462f9c8f24bcfe1fca22eb691d

    • SHA256

      eea615efc27f4dbaa20f493226caf399a4f5994fd1493f03ac75deffa81954d2

    • SHA512

      c30e7ec9283f1917b05fdbf952d145837ad407b3bdc5431d78cb6a0f70af3a0192f0373c4fc3aefb7cae9766b0813ba802241a4a51f4b7ae7dbffd42738daab4

    • SSDEEP

      12288:iat0EAH49n8BGe60O+/CRcDrNnyWP28xRqcrINVeAGXHbH6zAv2P5up+Jit:Nt24Je6BeC2yXKR0reNXHmzA0+

    Score
    10/10
    darkcometæåðòâàevasionpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks