General
-
Target
d2e1476217647ea61bc40f217754ced32825cb6d13bc3d5b18440c3b8cef10cc
-
Size
726KB
-
Sample
221201-acyewsgd93
-
MD5
815834954935b34a2d96f0249a8b4aca
-
SHA1
b01e3b78e8ea504a80420994cdd25b644d031bc2
-
SHA256
d2e1476217647ea61bc40f217754ced32825cb6d13bc3d5b18440c3b8cef10cc
-
SHA512
532882f306b2873b640c8236b283a705e5608d71ac7ef698a17c958702a86672cd43f22cbbd073140bd12b143c9fa231de45e0c246d741b383bde6b1bffb71a3
-
SSDEEP
12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLd9EkgC/hl0qeK3L:qZ1xuVVjfFoynPaVBUR8f+kN1PEWwzKb
Behavioral task
behavioral1
Sample
d2e1476217647ea61bc40f217754ced32825cb6d13bc3d5b18440c3b8cef10cc.exe
Resource
win7-20221111-en
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:81
DC_MUTEX-43TZZGV
-
gencode
k2ztQXlXVuZa
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Targets
-
-
Target
d2e1476217647ea61bc40f217754ced32825cb6d13bc3d5b18440c3b8cef10cc
-
Size
726KB
-
MD5
815834954935b34a2d96f0249a8b4aca
-
SHA1
b01e3b78e8ea504a80420994cdd25b644d031bc2
-
SHA256
d2e1476217647ea61bc40f217754ced32825cb6d13bc3d5b18440c3b8cef10cc
-
SHA512
532882f306b2873b640c8236b283a705e5608d71ac7ef698a17c958702a86672cd43f22cbbd073140bd12b143c9fa231de45e0c246d741b383bde6b1bffb71a3
-
SSDEEP
12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLd9EkgC/hl0qeK3L:qZ1xuVVjfFoynPaVBUR8f+kN1PEWwzKb
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-