General
-
Target
a029c91d07df53bb4e724184ad01a764363e7d0195890683ae4191ca19481453
-
Size
578KB
-
Sample
221130-seysjsag68
-
MD5
2d13c3a38b55a070d9e61fccbbbd8993
-
SHA1
607f920a98692246daefcc5459383d054f095d71
-
SHA256
a029c91d07df53bb4e724184ad01a764363e7d0195890683ae4191ca19481453
-
SHA512
8dd1de589cf104a5d572cb9d352617c105c061500b862301e583c624cb6740a883fbf07173f31bbcb2228b32b6a04610b53a24296d75b6444649b53661ec109d
-
SSDEEP
12288:kjzbCJ6ZP75FamPi2eNi8nKEaWMugN6WzzugmYj6weqcZRKLbUL:kjHU6pGy5etKEaWMP6WzWi4J
Static task
static1
Behavioral task
behavioral1
Sample
a029c91d07df53bb4e724184ad01a764363e7d0195890683ae4191ca19481453.exe
Resource
win7-20221111-en
Malware Config
Extracted
darkcomet
Guest16
thefinalblood1.no-ip.biz:1604
DC_MUTEX-QY19XK4
-
gencode
XlKMq2Lwge2E
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
a029c91d07df53bb4e724184ad01a764363e7d0195890683ae4191ca19481453
-
Size
578KB
-
MD5
2d13c3a38b55a070d9e61fccbbbd8993
-
SHA1
607f920a98692246daefcc5459383d054f095d71
-
SHA256
a029c91d07df53bb4e724184ad01a764363e7d0195890683ae4191ca19481453
-
SHA512
8dd1de589cf104a5d572cb9d352617c105c061500b862301e583c624cb6740a883fbf07173f31bbcb2228b32b6a04610b53a24296d75b6444649b53661ec109d
-
SSDEEP
12288:kjzbCJ6ZP75FamPi2eNi8nKEaWMugN6WzzugmYj6weqcZRKLbUL:kjHU6pGy5etKEaWMP6WzWi4J
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-