Overview

overview

10

Static

static

86c277d8dc...2a.exe

windows7-x64

10

86c277d8dc...2a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    86c277d8dc9db1a266d0e1bd6532998d29193d566d7c2d43da7619c0a90f412a

  • Size

    418KB

  • Sample

    221203-dbm5baca7w

  • MD5

    bf67fdf8fe29e6ec7308291511249a6e

  • SHA1

    b73c218ad338e3e8be83ef51e30c4f510e1d877c

  • SHA256

    86c277d8dc9db1a266d0e1bd6532998d29193d566d7c2d43da7619c0a90f412a

  • SHA512

    11a13d788bdd8f34fd5bf852a090f2e7a96e18805da34d4d7d8ae94fdf494a4ee45601f43ea5fe2ba407c3776f81bb8ededa2a320d2390bf997b61a01ba74364

  • SSDEEP

    12288:dey7BmWevJzUEWTBJ6fJGZ4JQLvISG6Ly1KsoPATVh9F4:dV7BmhzUEWCfJGRLn8Kj

Score
10/10
darkcomet1stpersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

1ST

C2

imohi999.zapto.org:1604

Mutex

DC_MUTEX-6F9QUAU

Attributes
  • gencode

    laeZe1tFmb5q

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      86c277d8dc9db1a266d0e1bd6532998d29193d566d7c2d43da7619c0a90f412a

    • Size

      418KB

    • MD5

      bf67fdf8fe29e6ec7308291511249a6e

    • SHA1

      b73c218ad338e3e8be83ef51e30c4f510e1d877c

    • SHA256

      86c277d8dc9db1a266d0e1bd6532998d29193d566d7c2d43da7619c0a90f412a

    • SHA512

      11a13d788bdd8f34fd5bf852a090f2e7a96e18805da34d4d7d8ae94fdf494a4ee45601f43ea5fe2ba407c3776f81bb8ededa2a320d2390bf997b61a01ba74364

    • SSDEEP

      12288:dey7BmWevJzUEWTBJ6fJGZ4JQLvISG6Ly1KsoPATVh9F4:dV7BmhzUEWCfJGRLn8Kj

    Score
    10/10
    darkcomet1stpersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks