Overview

overview

10

Static

static

67a17e35ea...73.exe

windows7-x64

10

67a17e35ea...73.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67a17e35ea7397dac20836226787f252311581166ee4086c78fdcbab1f85d473

  • Size

    692KB

  • Sample

    221129-nthyeshf6y

  • MD5

    94416f1ba0b5a264346856a0f35cac0f

  • SHA1

    39a3c585f11e7fbf252098b75219d2fbe34dbe9b

  • SHA256

    67a17e35ea7397dac20836226787f252311581166ee4086c78fdcbab1f85d473

  • SHA512

    f78dfb12489aea3afb6bf5a79243ca766670bcd983689e2ecc5cd1e11f008d0a1e66fe7ffcc8beda5a4ff3c7d6ab8e1d5fbd6d3f09a55e75f34598db578be09f

  • SSDEEP

    12288:Qj+ReNridFsEbhb2eextOd7HIQcgwfqF1ayAouHiIg2k4x:Qj+8R0FPbhbbexkpWgwkAHHtk

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      67a17e35ea7397dac20836226787f252311581166ee4086c78fdcbab1f85d473

    • Size

      692KB

    • MD5

      94416f1ba0b5a264346856a0f35cac0f

    • SHA1

      39a3c585f11e7fbf252098b75219d2fbe34dbe9b

    • SHA256

      67a17e35ea7397dac20836226787f252311581166ee4086c78fdcbab1f85d473

    • SHA512

      f78dfb12489aea3afb6bf5a79243ca766670bcd983689e2ecc5cd1e11f008d0a1e66fe7ffcc8beda5a4ff3c7d6ab8e1d5fbd6d3f09a55e75f34598db578be09f

    • SSDEEP

      12288:Qj+ReNridFsEbhb2eextOd7HIQcgwfqF1ayAouHiIg2k4x:Qj+8R0FPbhbbexkpWgwkAHHtk

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks