Overview

overview

10

Static

static

89cdf7c759...9c.exe

windows7-x64

10

89cdf7c759...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c

  • Size

    416KB

  • Sample

    221202-zmxc1sgd6v

  • MD5

    9539e0727dd07c8c9ac33b199c23771e

  • SHA1

    b3d6376f44c8463ea7e24b84587c0d88de73f70a

  • SHA256

    89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c

  • SHA512

    c902098a4b7dd5b584351edabf685aef0df81d5b27a02d20ea6d20f6e87712903349f3803b5682b948ffc9fbad13f3ee2eb59f5125efc4f01ee1742babf36c89

  • SSDEEP

    12288:ENktTWDAyUNh/lMQo1cr/Ihi2TOsfKJcZLTsEJqPKe:dAO/ML10IhiCOsKJcZLgnPKe

Score
10/10
darkcometevasionrattrojanupx

Malware Config

Targets

    • Target

      89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c

    • Size

      416KB

    • MD5

      9539e0727dd07c8c9ac33b199c23771e

    • SHA1

      b3d6376f44c8463ea7e24b84587c0d88de73f70a

    • SHA256

      89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c

    • SHA512

      c902098a4b7dd5b584351edabf685aef0df81d5b27a02d20ea6d20f6e87712903349f3803b5682b948ffc9fbad13f3ee2eb59f5125efc4f01ee1742babf36c89

    • SSDEEP

      12288:ENktTWDAyUNh/lMQo1cr/Ihi2TOsfKJcZLTsEJqPKe:dAO/ML10IhiCOsKJcZLgnPKe

    Score
    10/10
    darkcometevasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks