Overview

overview

10

Static

static

8

80c01eb509...07.exe

windows7-x64

10

80c01eb509...07.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80c01eb5095f443ee91733e875ca3ad9f208453792ce6f3f7825555993e77607

  • Size

    820KB

  • Sample

    221203-c44r4agd25

  • MD5

    335348bdde8b7504a4c4fc5ac784cdff

  • SHA1

    4bb83a1aad1dbd89ccb0278a002b4914923ae1f3

  • SHA256

    80c01eb5095f443ee91733e875ca3ad9f208453792ce6f3f7825555993e77607

  • SHA512

    da87e3ee0bd5bd2f55dfe292034df51ee8ff41b57ba739ea2ba3492045bfd3cede36fa5bdad8ae365a9f86703cda55e13b30f35ee2245491fa88615984c3a024

  • SSDEEP

    24576:/L+CsgR8Qn8TFJe48USD6gMmGo7O4gKgulRBm:D+Cv8+6Fk4dSQm97gK9g

Score
10/10
darkcometxvjsdkfpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

xvjsdkf

C2

74.109.119.83:1905

Mutex

DCMIN_MUTEX-D1LGNER

Attributes
  • gencode

    fasCeqn8BZ5i

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      80c01eb5095f443ee91733e875ca3ad9f208453792ce6f3f7825555993e77607

    • Size

      820KB

    • MD5

      335348bdde8b7504a4c4fc5ac784cdff

    • SHA1

      4bb83a1aad1dbd89ccb0278a002b4914923ae1f3

    • SHA256

      80c01eb5095f443ee91733e875ca3ad9f208453792ce6f3f7825555993e77607

    • SHA512

      da87e3ee0bd5bd2f55dfe292034df51ee8ff41b57ba739ea2ba3492045bfd3cede36fa5bdad8ae365a9f86703cda55e13b30f35ee2245491fa88615984c3a024

    • SSDEEP

      24576:/L+CsgR8Qn8TFJe48USD6gMmGo7O4gKgulRBm:D+Cv8+6Fk4dSQm97gK9g

    Score
    10/10
    darkcometxvjsdkfpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks