darkcomet | a14c1f7f6eea2459f93fc4635c9e61527bd6231a482a28fb65f82d14c0cb6ab7

Sharing

Copy URL Twitter E-mail

General

Target

a14c1f7f6eea2459f93fc4635c9e61527bd6231a482a28fb65f82d14c0cb6ab7
Size

800KB
MD5

f4833f3881ef6e337047fa0ffe2ca7fc
SHA1

0c359209020222a5d8e671ba570c48461598105c
SHA256

a14c1f7f6eea2459f93fc4635c9e61527bd6231a482a28fb65f82d14c0cb6ab7
SHA512

15eea63065de16666e28cbdc677fdf23bc60fc0ba5e084bf2e96d773e16e0e41c8932721c3221a5032519e8ca8d055675ff193939c786a34278247da20ff3ef0
SSDEEP

12288:RgHMH9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKb:REMdAQ6Zx9cxTmOrucTIEFSpOGW

Score

10^/10

darkcomet

Malware Config

Signatures

Darkcomet family
darkcomet

Files

a14c1f7f6eea2459f93fc4635c9e61527bd6231a482a28fb65f82d14c0cb6ab7
.exe windows x86

4459f01a67eea4e98e0add51bb00b2f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
modf
strrchr
strchr
_strnicmp
??3@YAXPAX@Z
strtod
tolower
malloc
realloc
free
??2@YAPAXI@Z
strncpy
_stricmp
toupper
_ftol
atoi
sprintf
strncmp

kernel32

GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
CloseHandle
Process32Next
OpenEventA
CreateEventA
Module32First
CreateWaitableTimerA
SetWaitableTimer
LocalSize
RtlMoveMemory
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
WaitForSingleObject
GetEnvironmentVariableA
lstrcpyn
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileA
GetStartupInfoA
GetUserDefaultLCID

user32

GetClassNameA
GetWindowThreadProcessId
ShowWindow
IsWindowVisible
TranslateMessage
ShowWindowAsync
GetWindowTextA
SetForegroundWindow
MsgWaitForMultipleObjects
EnumChildWindows
PostMessageA
MessageBoxA
wsprintfA
DispatchMessageA
PeekMessageA
GetMessageA
EnumWindows
GetInputState

advapi32

CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA

ole32

CLSIDFromProgID
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CLSIDFromString

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetSetCookieA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
HttpSendRequestA

shlwapi

PathFileExistsA
PathFindFileNameA

ntdll

ZwUnmapViewOfSection
RtlAdjustPrivilege
NtShutdownSystem

oleaut32

SafeArrayGetUBound
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
VariantChangeType
SafeArrayGetDim
SafeArrayGetLBound
LoadTypeLi
VariantInit

Sections

.text
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 676KB - Virtual size: 720KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4459f01a67eea4e98e0add51bb00b2f3

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

ole32

wininet

shlwapi

ntdll

oleaut32

Sections

.text Size: 68KB - Virtual size: 64KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 676KB - Virtual size: 720KB

.text
Size: 68KB - Virtual size: 64KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 676KB - Virtual size: 720KB