General
-
Target
17a956e5cc9ac793770ab221568ccb46a950e3b3fba342e4c3d141025c84ab91.exe
-
Size
520KB
-
Sample
230405-m65saagb5t
-
MD5
e0dd78d81cf2af240f44952d54ff4ceb
-
SHA1
b9eae07673c3139cb8f0e23ca073f583f0a27f75
-
SHA256
17a956e5cc9ac793770ab221568ccb46a950e3b3fba342e4c3d141025c84ab91
-
SHA512
9055a8a47cc645a2ac795f5877b0c071681c037be5bae10a0b8e2b92d66a594bab4874b678851e1fe47e31583b92a25215dafbe054d511446b70df130c8318bf
-
SSDEEP
6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbl:f9fC3hh29Ya77A90aFtDfT5IMbl
Static task
static1
Behavioral task
behavioral1
Sample
17a956e5cc9ac793770ab221568ccb46a950e3b3fba342e4c3d141025c84ab91.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
17a956e5cc9ac793770ab221568ccb46a950e3b3fba342e4c3d141025c84ab91.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
darkcomet
PrivateEye
ratblackshades.no-ip.biz:1604
DC_MUTEX-ACC1R98
-
gencode
8GG5LVVGljSF
-
install
false
-
offline_keylogger
true
-
persistence
false
Targets
-
-
Target
17a956e5cc9ac793770ab221568ccb46a950e3b3fba342e4c3d141025c84ab91.exe
-
Size
520KB
-
MD5
e0dd78d81cf2af240f44952d54ff4ceb
-
SHA1
b9eae07673c3139cb8f0e23ca073f583f0a27f75
-
SHA256
17a956e5cc9ac793770ab221568ccb46a950e3b3fba342e4c3d141025c84ab91
-
SHA512
9055a8a47cc645a2ac795f5877b0c071681c037be5bae10a0b8e2b92d66a594bab4874b678851e1fe47e31583b92a25215dafbe054d511446b70df130c8318bf
-
SSDEEP
6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbl:f9fC3hh29Ya77A90aFtDfT5IMbl
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-