General
-
Target
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae
-
Size
660KB
-
Sample
221201-l3h9fabh4y
-
MD5
0092838bfe137c5b3cb81384cc752a10
-
SHA1
58135f256464a3b4fc82473244f45da8dadd0048
-
SHA256
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae
-
SHA512
452aa9eab9363ce4cc0d763632389496905aa46def3d2338831175d6a90f1466bf96914b759b18892e00933db6b83bcbdae266f515bf6259ce88905784323155
-
SSDEEP
12288:0XhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UG:inAw2WWeFcfbP9VPSPMTSPL/rWvzq4JW
Behavioral task
behavioral1
Sample
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe
Resource
win7-20221111-en
Malware Config
Extracted
darkcomet
Tim
trollo.zapto.org:1605
DC_MUTEX-4CC7RLB
-
InstallPath
svhost\svhost.exe
-
gencode
iKWKGxcC6jL6
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
svhost
Targets
-
-
Target
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae
-
Size
660KB
-
MD5
0092838bfe137c5b3cb81384cc752a10
-
SHA1
58135f256464a3b4fc82473244f45da8dadd0048
-
SHA256
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae
-
SHA512
452aa9eab9363ce4cc0d763632389496905aa46def3d2338831175d6a90f1466bf96914b759b18892e00933db6b83bcbdae266f515bf6259ce88905784323155
-
SSDEEP
12288:0XhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UG:inAw2WWeFcfbP9VPSPMTSPL/rWvzq4JW
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-