darkcomet

General

Target

9dd6aa8492f37d86fc48a53129be774d7516e11590eeb5ef57d2949f3640b5b0
Size

1.4MB
Sample

221128-tpqelaga65
MD5

2678e099d306f8d5b3f36ffcfe2188fd
SHA1

665919923d952296261426b3f30591f03096e3dd
SHA256

9dd6aa8492f37d86fc48a53129be774d7516e11590eeb5ef57d2949f3640b5b0
SHA512

c7bd86be7885fe24283aa06f62ffa535cfb8d97942da1260dfb37117cb8c126d854c93af9e3cc375644499a3e67a3dcd6dfa68dcadf487129c5b8e1d0df9af46
SSDEEP

24576:nWqnseROCQ2fUKVfDDeAPQL79hEZUcghKf+ZTEIfYNvYwu8OsfDRdph6NOQ0kOgo:Fs7CQcBDiAoHrEarhAXIfOYwuUwF/jU

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Ite 18/02

C2

daviswc.zapto.org:1211

Mutex

DC_MUTEX-GDFT72L

Attributes

gencode
Xoe3LkQ008MU
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  
  9dd6aa8492f37d86fc48a53129be774d7516e11590eeb5ef57d2949f3640b5b0
- Size
  
  1.4MB
- MD5
  
  2678e099d306f8d5b3f36ffcfe2188fd
- SHA1
  
  665919923d952296261426b3f30591f03096e3dd
- SHA256
  
  9dd6aa8492f37d86fc48a53129be774d7516e11590eeb5ef57d2949f3640b5b0
- SHA512
  
  c7bd86be7885fe24283aa06f62ffa535cfb8d97942da1260dfb37117cb8c126d854c93af9e3cc375644499a3e67a3dcd6dfa68dcadf487129c5b8e1d0df9af46
- SSDEEP
  
  24576:nWqnseROCQ2fUKVfDDeAPQL79hEZUcghKf+ZTEIfYNvYwu8OsfDRdph6NOQ0kOgo:Fs7CQcBDiAoHrEarhAXIfOYwuUwF/jU
Score

10^/10

persistence upx darkcomet hawkeye ite 18/02 collection keylogger rat spyware stealer trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2