Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a

  • Size

    1.7MB

  • Sample

    221127-27d4aafc95

  • MD5

    af2d7fb9fbf0fb5ccb3736a50595e1c2

  • SHA1

    40a547cf32cf77b993963a7833a2b9981ef82acd

  • SHA256

    bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a

  • SHA512

    b06be7a07a521542da36a773c1b7f565938147928ed515182de1922bb1a60333a25118219eeeb7a113473dce028d115b15445d4087e11bae42b4d6736f5396ee

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iadvKmxTBNWyrAr7Kl3ysb375I8AS0fhGT48qlc:mJZoQrbTFZY1iaJ/Rro7Kl3ysK8A6X

Malware Config

Extracted

Family

darkcomet

Botnet

Vecxed

C2

clients.no-ip.org:1337

Mutex

DC_MUTEX-YX2DBVE

Attributes
  • gencode

    hYAo19VcEYz5

  • install

    false

  • offline_keylogger

    true

  • password

    Vicious1234

  • persistence

    false

Targets

    • Target

      bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a

    • Size

      1.7MB

    • MD5

      af2d7fb9fbf0fb5ccb3736a50595e1c2

    • SHA1

      40a547cf32cf77b993963a7833a2b9981ef82acd

    • SHA256

      bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a

    • SHA512

      b06be7a07a521542da36a773c1b7f565938147928ed515182de1922bb1a60333a25118219eeeb7a113473dce028d115b15445d4087e11bae42b4d6736f5396ee

    • SSDEEP

      24576:pRmJkcoQricOIQxiZY1iadvKmxTBNWyrAr7Kl3ysb375I8AS0fhGT48qlc:mJZoQrbTFZY1iaJ/Rro7Kl3ysK8A6X

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies visiblity of hidden/system files in Explorer

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks