General
-
Target
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
-
Size
383KB
-
Sample
221126-pv7hvagb2x
-
MD5
4ae30f28f1acb06cc303afb107fb5242
-
SHA1
017ed0e76ed7daee651f88c81df2f43c986a773c
-
SHA256
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
-
SHA512
015292b13b5712357e9b7f33cb9097884b15578598c066a1fc5a272b8cddcfffe42bc6a9fa499ffae43ce245967ce005234ead3b50cf304f84f3666f06de8f16
-
SSDEEP
6144:/YpRNQuZi9+neeKGn4SBIz0Bpv/8Ykw+aS053PuLupGT1CXINTB8LgAFAl7B9w:wp/1Fxn+G8S+aL3GapyfB2GR
Static task
static1
Behavioral task
behavioral1
Sample
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe
Resource
win7-20220812-en
Malware Config
Extracted
darkcomet
HF
xavian.no-ip.org:1604
DC_MUTEX-KT2FTNQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
VKesLADk0mNy
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
-
Size
383KB
-
MD5
4ae30f28f1acb06cc303afb107fb5242
-
SHA1
017ed0e76ed7daee651f88c81df2f43c986a773c
-
SHA256
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
-
SHA512
015292b13b5712357e9b7f33cb9097884b15578598c066a1fc5a272b8cddcfffe42bc6a9fa499ffae43ce245967ce005234ead3b50cf304f84f3666f06de8f16
-
SSDEEP
6144:/YpRNQuZi9+neeKGn4SBIz0Bpv/8Ykw+aS053PuLupGT1CXINTB8LgAFAl7B9w:wp/1Fxn+G8S+aL3GapyfB2GR
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-