Overview

overview

10

Static

static

c00ffecc0b...f5.exe

windows7-x64

10

c00ffecc0b...f5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c00ffecc0b57ba10a250514ca7893c5126e62201d17a80d34dd4409fca6ab0f5

  • Size

    732KB

  • Sample

    221127-v3z2maeg53

  • MD5

    824043b07357ea6207bfca14bddb489e

  • SHA1

    de7222d9251068fa2986c85dc3f958c44e54dc02

  • SHA256

    c00ffecc0b57ba10a250514ca7893c5126e62201d17a80d34dd4409fca6ab0f5

  • SHA512

    d32035b001f4c74ea0998acc9a0aebcd92dd1871c10777661009128887c5e0df3071b3591fb13de8d4cff67a7528ef9f2bfb562ef79ab4ea39380ec5d3a85213

  • SSDEEP

    12288:TZgLnW39p0PwPGtu1/7zEGEQ2g5dRiSgrTaiVCH1AgTfR9xrL5:Te639p0ftuB7zL28ASgtCVAgTJL

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      c00ffecc0b57ba10a250514ca7893c5126e62201d17a80d34dd4409fca6ab0f5

    • Size

      732KB

    • MD5

      824043b07357ea6207bfca14bddb489e

    • SHA1

      de7222d9251068fa2986c85dc3f958c44e54dc02

    • SHA256

      c00ffecc0b57ba10a250514ca7893c5126e62201d17a80d34dd4409fca6ab0f5

    • SHA512

      d32035b001f4c74ea0998acc9a0aebcd92dd1871c10777661009128887c5e0df3071b3591fb13de8d4cff67a7528ef9f2bfb562ef79ab4ea39380ec5d3a85213

    • SSDEEP

      12288:TZgLnW39p0PwPGtu1/7zEGEQ2g5dRiSgrTaiVCH1AgTfR9xrL5:Te639p0ftuB7zL28ASgtCVAgTJL

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks