General
-
Target
https://github.com/daedalus/NanoCore/archive/refs/heads/master.zip
-
Sample
230310-1f5w9ahc3y
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
IDMAN
C2
arrivals.ddns.net:2323
Mutex
DC_MUTEX-391X2ZJ
Attributes
-
InstallPath
MSDCSC\IDMAN.exe
-
gencode
CUWbhGwmWBMb
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
IDMAN
Targets
-
-
Target
https://github.com/daedalus/NanoCore/archive/refs/heads/master.zip
Score10/10-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-