General
-
Target
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b
-
Size
300KB
-
Sample
221202-1tt2xagh88
-
MD5
cc0b280b1138859bedd6af39377526a5
-
SHA1
861cecd1d68a5ee192e69e5f1cf028114ec1b7af
-
SHA256
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b
-
SHA512
b002cfc305630fca9c6af061ff032aae88ae0aaa185628808d717ce1eb0ef4802d916a9f78e8582b97e64981d7f1c0ecce4eee35df9f6c5e2d2bbcbead5d51ff
-
SSDEEP
6144:YRk2kQjwtxwiG9Gl9St23NZCB0lsvW8gco/LDLPOj03p2KZhE:YR49x6EmslevWQIHDOj03p2
Static task
static1
Behavioral task
behavioral1
Sample
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe
Resource
win7-20221111-en
Malware Config
Extracted
darkcomet
Guest16
jjb4xt3r.myftp.biz:1604
DC_MUTEX-8JY3N3Z
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
SjbmmcfPKkjH
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b
-
Size
300KB
-
MD5
cc0b280b1138859bedd6af39377526a5
-
SHA1
861cecd1d68a5ee192e69e5f1cf028114ec1b7af
-
SHA256
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b
-
SHA512
b002cfc305630fca9c6af061ff032aae88ae0aaa185628808d717ce1eb0ef4802d916a9f78e8582b97e64981d7f1c0ecce4eee35df9f6c5e2d2bbcbead5d51ff
-
SSDEEP
6144:YRk2kQjwtxwiG9Gl9St23NZCB0lsvW8gco/LDLPOj03p2KZhE:YR49x6EmslevWQIHDOj03p2
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-