Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4a798faf015bbbc263a0de880c66c5ddd858d9daa75876474cea18ca8ed3c248

  • Size

    720KB

  • Sample

    221205-r43blaaa97

  • MD5

    f5ec22b04ff24ba717ef4f7c567f8e52

  • SHA1

    51bd7372c4f9d1b90f43d0f5d1d080bda770d043

  • SHA256

    4a798faf015bbbc263a0de880c66c5ddd858d9daa75876474cea18ca8ed3c248

  • SHA512

    0e5f67c8f45cf5c304fb7fc1601174a036d86fde6fdfee7d0efd2616d690fc6bd7fbafcd64ba749c9fe874eb31235bb161b9fd02bb63c550e0cd090f25ce9512

  • SSDEEP

    12288:jrgXPhw9xGblYKJPa2dILqneS4+oVOcb9hd8qOFINneXFXgIv5VhmkQWNMf:4XOu9HIL9XOcb9hdNOFINeXb00Ne

Malware Config

Extracted

Family

darkcomet

Botnet

silk

C2

chinahacking.zapto.org:1509

Mutex

DC_MUTEX-KGBE2JX

Attributes
  • gencode

    BqtloSbbcP1S

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      4a798faf015bbbc263a0de880c66c5ddd858d9daa75876474cea18ca8ed3c248

    • Size

      720KB

    • MD5

      f5ec22b04ff24ba717ef4f7c567f8e52

    • SHA1

      51bd7372c4f9d1b90f43d0f5d1d080bda770d043

    • SHA256

      4a798faf015bbbc263a0de880c66c5ddd858d9daa75876474cea18ca8ed3c248

    • SHA512

      0e5f67c8f45cf5c304fb7fc1601174a036d86fde6fdfee7d0efd2616d690fc6bd7fbafcd64ba749c9fe874eb31235bb161b9fd02bb63c550e0cd090f25ce9512

    • SSDEEP

      12288:jrgXPhw9xGblYKJPa2dILqneS4+oVOcb9hd8qOFINneXFXgIv5VhmkQWNMf:4XOu9HIL9XOcb9hdNOFINeXb00Ne

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks