Overview

overview

10

Static

static

8e45b8a93f...cd.exe

windows7-x64

10

8e45b8a93f...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e45b8a93f248d1aef82d5487f17093e3e319bcfe47dcef8ec15e85e5719dbcd

  • Size

    850KB

  • Sample

    221128-pyjwysde75

  • MD5

    6556aabfd6a3707d1ddff120f977aa8c

  • SHA1

    dda2c9deb3c036466ee55cddd2ef60a6016acece

  • SHA256

    8e45b8a93f248d1aef82d5487f17093e3e319bcfe47dcef8ec15e85e5719dbcd

  • SHA512

    1bc4345a33041a4a7c6136378cb4d4cfe2eb788e880f8a48de278e1c60407bf29d8a93d2fd1576de38c07cc8ea73cfa4bf856afad60e9f1e432fcf08e70c1320

  • SSDEEP

    12288:DAHodVfcRkTIE21Qi8gHGgZFcQT3P+XqOeo1UgpKL:DUodNcReZ2pHlxT3W7eo6yKL

Score
10/10
darkcomet01/04/2015persistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

01/04/2015

C2

takavorine.no-ip.org:1604

takavore.no-ip.org:1604
Mutex

DC_MUTEX-KB3ARJQ

Attributes
  • gencode

    hXyDyhpL68Fr

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      8e45b8a93f248d1aef82d5487f17093e3e319bcfe47dcef8ec15e85e5719dbcd

    • Size

      850KB

    • MD5

      6556aabfd6a3707d1ddff120f977aa8c

    • SHA1

      dda2c9deb3c036466ee55cddd2ef60a6016acece

    • SHA256

      8e45b8a93f248d1aef82d5487f17093e3e319bcfe47dcef8ec15e85e5719dbcd

    • SHA512

      1bc4345a33041a4a7c6136378cb4d4cfe2eb788e880f8a48de278e1c60407bf29d8a93d2fd1576de38c07cc8ea73cfa4bf856afad60e9f1e432fcf08e70c1320

    • SSDEEP

      12288:DAHodVfcRkTIE21Qi8gHGgZFcQT3P+XqOeo1UgpKL:DUodNcReZ2pHlxT3W7eo6yKL

    Score
    10/10
    darkcomet01/04/2015persistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks