darkcomet

Sharing

Copy URL

Twitter E-mail

General

Target

bd1.rar
Size

6MB
Sample

230911-lhjpgafb86
MD5

cace628797b6d03a3236ad21bd7e9348
SHA1

456f041b22123ab97df259354622b69ecc87caf4
SHA256

8daf49c8f6347d60e159d64eb95f84fa840b68a663cc3461f88a44442c04711c
SHA512

e7bb0a645b08338d827ee67a09ee8e388e3b3d50ef1e2d074d4dcfecf15dd4046fc56953b40473dc852830a025018e5e9d1f4add1349dd55c3a670f86acc3816
SSDEEP

196608:tALJiUchr7XLOsqB9oJfVhWh2wBAkKD8BwwoweSS+YoE:tAN/chrzisqBCJNhWhrBA5gqpwe5wE

Score

10^/10

Malware Config

Targets

- Target
  
  02e5681e6f30ad7e6fef313c71e28e55182d16c513e174064a6d27ad80da8a08
- Size
  
  125KB
- MD5
  
  f38021136fab51f2cf682240147044ce
- SHA1
  
  e2b8f8a1b195a0ae13c6feb0038355b03c34f210
- SHA256
  
  02e5681e6f30ad7e6fef313c71e28e55182d16c513e174064a6d27ad80da8a08
- SHA512
  
  25356eae1b3ea9a237a5922a23d627b1f268770afbf74247fbf1be15bd4c287a7da5879b06213042244bedf0c2a060a4d1167e7bf45937af784f94957198cef2
- SSDEEP
  
  1536:PGEmhhG+YgqyRaI10G1qysYLtz1hXGxLhF6kozo7x5N7dxPJ+6rvn:PGEEhG+FqyRzVqGfZGNhFeoFJxPJ
Score

3^/10
behavioral1
- Target
  
  09f2e047a1ca2ac9f5b84fb3f9383a001eab0f64bec40ee48f5ffd4e6ead355f
- Size
  
  356KB
- MD5
  
  969f62f4e1b16fe76cfd23417fb24573
- SHA1
  
  d248debea842eb9d1fbbb442731e58ee4af091d6
- SHA256
  
  09f2e047a1ca2ac9f5b84fb3f9383a001eab0f64bec40ee48f5ffd4e6ead355f
- SHA512
  
  3fbe7f84ddc158a27073a50319f23a76f053f88cdfc4e12487b49f3c3f499efb71cc62b837fbfb1602a36e3a97e9f90fdc8617b1a2041fa639c21cdaeb3fc541
- SSDEEP
  
  6144:M3PP82A8VCUXTBJvuKGFhLlaVCoGnQ7Psr9lDkdvynPW9IZvsm:M3PU2AAC2TDvuRFVQjsvDAvynztsm
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral2
- Target
  
  0c60386168f9960c079054a76cec5fa0350ed0e0df7670216a21f635a0fd0117
- Size
  
  28KB
- MD5
  
  ca4df89d01def64c6090620675cce200
- SHA1
  
  36a4f1afa02aea180db62ffc1c3b13454383b6d7
- SHA256
  
  0c60386168f9960c079054a76cec5fa0350ed0e0df7670216a21f635a0fd0117
- SHA512
  
  d011f70b703e42e84c3c55400233f85877730ba69b0194ac17f7629778465a167c423f19f265c7a35dea68831f17f697125cf9ed3bec214f33ac6fd764a9b3d8
- SSDEEP
  
  384:LmOyMLjKMPH1Dxw7ZA8l9ZoA7k+w9G5hmssR0IkR46nzojn8mgRRtssIeo/r5J16:GUjKVjl9xw3x6nz7vj1wrM
Score

1^/10
behavioral3
- Target
  
  0f91056771733a546c4d599c0f19575bfa3f1b38dad026ad73f04a9e425f79d6
- Size
  
  447KB
- MD5
  
  9d66dfff59e92748dcfd401a45539147
- SHA1
  
  0c15175f4e7e002aae66e3b4e13b913bccd19bd1
- SHA256
  
  0f91056771733a546c4d599c0f19575bfa3f1b38dad026ad73f04a9e425f79d6
- SHA512
  
  7d6d5c1ea3886b4e9fc951575e4ccd25b04ef003fd0254a74ceaffebdd5ad24bde94b6014d1752ae8b0e4d571227604355bd56f9a79606f402f2b32c1c9c6a60
- SSDEEP
  
  6144:4Mi58rMySh71a0f8AisSwX/7fpZn+XfV7oHWdj5Riene/9zPNezzAAra7UzjRx/Q:m58rMyG1q/Q7T+Xm87ie+Pwzxaw3WR
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
behavioral4
- Target
  
  0fa29bb6a013d5a79ec9086a7bbb521af5899c8ec9cb35d741ed393c841f41d9
- Size
  
  28KB
- MD5
  
  d160e25c57ec928076a475f1a8885f0d
- SHA1
  
  2a1d49ef0734fb47133ddf61b90000f887e97d9d
- SHA256
  
  0fa29bb6a013d5a79ec9086a7bbb521af5899c8ec9cb35d741ed393c841f41d9
- SHA512
  
  85eeb6a11c83b88bb96091a3168f37208f679ba1baba00e499e0847fe58cead7587cb751863ac367aa05e4e35ea7b7f2e9af67797baa0196602a0b0c8510d826
- SSDEEP
  
  384:ygf1E4aDVChV8TorfNK+gAsmjU0ElRqZSPzK42LmgIgHdX:VE40Q7nrVeAvY0K3PR25Bd
Score

3^/10
behavioral5
- Target
  
  0fca203a53f2726e137090da3d609b8573defffc4644394b546bc5f7e36cddeb
- Size
  
  344KB
- MD5
  
  86d09e3fc368fc060efdd9ca256598c7
- SHA1
  
  734d9fa2097f606483fb40e7dcc497f28f00a989
- SHA256
  
  0fca203a53f2726e137090da3d609b8573defffc4644394b546bc5f7e36cddeb
- SHA512
  
  1e368308e758de83d6f2997a38b3c7d8e4504e3b0ab059e5f4430b083b6efb94ea154a20c51ec5f872d80a1a00f60eaf879358add13a0ea6e750b6d1a1a8191c
- SSDEEP
  
  6144:3MgRwm0+zrZT/lfBtreOTj2klHbCroPeUYnWPPlbL:3MewEzRnWkl70oBS
Score

10^/10

darkcomet evasion persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral6
- Target
  
  14c97f29abe33f8d4c7c1231707ad925f3744d3a632fc797a9f85ff1d0154b69
- Size
  
  40KB
- MD5
  
  f47e516cf042ede0a290704753c7ae42
- SHA1
  
  a08433ed68a53c262bcd4ae0a21dcaadd878fba6
- SHA256
  
  14c97f29abe33f8d4c7c1231707ad925f3744d3a632fc797a9f85ff1d0154b69
- SHA512
  
  17cb332bb27121efbc127861fd72ad5b3390b96f357e877b0ebd6f5f304426c4ebb861baf0894fc9ca16ab8a3e36574447e4941b115c280e565c03df49ea9c67
- SSDEEP
  
  768:uDxhflbDkq1Fgx+GdBRnHWwj/PAc4seqaZjYarWtI2ntW7G/evUnqVvLNtR:ETfdDkq1FcljAmCjRrWe2nKVTX
Score

6^/10

persistence
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
behavioral7
- Target
  
  19a41a5c55e5f1bca43a83a84e722601d782100eb03f4bead22d6d9a7d39facc
- Size
  
  34KB
- MD5
  
  f2e398133fcf41fd5838e5da950e14e6
- SHA1
  
  a7bf756dc333d13c75d437097916b8b8dc7c67d2
- SHA256
  
  19a41a5c55e5f1bca43a83a84e722601d782100eb03f4bead22d6d9a7d39facc
- SHA512
  
  1de2363428591d6ea10309f8619673a42a01cf3effa87501886b165c9ce57f679a8c4e8b0755c0c5b49a3e558eff093fefdd076dc1cef6108758a742e6c5f2e1
- SSDEEP
  
  384:fPJzRuQMF1AC6nelp09vKjBwSmlNyMKbIf1xntM6UJoAFe4dFPETYDvHCdcEmYd5:fhzpga+p01KjaLeE3tUtLDVCPmzrlC3x
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral8
- Target
  
  1a0e5f3dff580e75483673b3b7920845f7c498383f0951dc8bbb555b33317d8e
- Size
  
  178KB
- MD5
  
  609ea170a67c125340c4162e550dfecc
- SHA1
  
  6551d2fab520c2447bae0136ce3e2d6800dc63b5
- SHA256
  
  1a0e5f3dff580e75483673b3b7920845f7c498383f0951dc8bbb555b33317d8e
- SHA512
  
  adf9046afb9f484f7d19676d74217a8233f1079ee587207dc199ddc34b23610fe9721cf6ea0afa72d912102c7c91c11ed23fc3d50e5f455d1ec1324f0cb4a4ff
- SSDEEP
  
  3072:x64MKbOFxL/xjzq+5BUaFPmgRMNlPTGQQm6ytwZEsrYkK4Py6u3Oh:x64dc/B98gWNlPTGQQm6agrdf
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral9
- Target
  
  1a6450cf1215e44204bce18178d79c9e2bb6167e8171e9afaff5c987228f2b7d
- Size
  
  256KB
- MD5
  
  1149c42fd8cf3ca7d00ef55a6337befe
- SHA1
  
  ff587ceab3ff9b010e95af422e1918d962daba14
- SHA256
  
  1a6450cf1215e44204bce18178d79c9e2bb6167e8171e9afaff5c987228f2b7d
- SHA512
  
  6ba4723b586ae303df42dc650e7b01971936dc1ab85a2e743525e1f9989523803170052118cdafd84d03157aa7e6251d8abce664dea07334b97446e7b83ecf1b
- SSDEEP
  
  6144:AiQO7EX3bIRg6RaMNrztSf7rDFhewqEA1868oHXEBnL:AiQO7EHbUTR3NrzIf7PFhZ68oH
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral10
- Target
  
  2e2d57e5404a66c05e903e86000b80b9b81696aeb505cffb5be693bd172e46b9
- Size
  
  418KB
- MD5
  
  1dca4dd387e8d9da52692e6d9e5894a7
- SHA1
  
  5896da511258ee1507e0ce626f440da7bef3a730
- SHA256
  
  2e2d57e5404a66c05e903e86000b80b9b81696aeb505cffb5be693bd172e46b9
- SHA512
  
  c8d4e7d34552e4d8d2305915f32ca9fbf7a28cb2b19e150e556cc8818ec0333ac3e474ebd8b497fac71475f4f38e28bf923905abcdf7ab5d90d1844e126b7dff
- SSDEEP
  
  12288:Y0dePKEjttr+ttrRttr0ttrXttrBttrKttrdxx:7dkt1+t1Rt10t1Xt1Bt1Kt17
Score

1^/10
behavioral11
- Target
  
  2fc5993f8506aae3878cc465e1dc0f0544cc677051800bfb14c75f46b54ed132
- Size
  
  8KB
- MD5
  
  e5506b9240d40f78d9ffb36f7e5dddf8
- SHA1
  
  284925fa922e98fa590f13955dfe5b3e4deb9b98
- SHA256
  
  2fc5993f8506aae3878cc465e1dc0f0544cc677051800bfb14c75f46b54ed132
- SHA512
  
  10398db10ef6962ffbca28ef69457c07399bce4bcaf413e5748cf2c9e646c74a55f0e8f9958bc612c22b2705e6cacfcd072f558036deecf275413b7ff96ea836
- SSDEEP
  
  96:ZaEGBEWF9vuFToKMkxM59+TjeGXSVVdnpyW:Z8CfFTolkxM59+ve1VVyW
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral12
- Target
  
  32c2f259971bc088c50524880b4a4f3cc1439e30c6d6c891956d386a25bb7b57
- Size
  
  35KB
- MD5
  
  b83c2a395212759e4562e5b6b6d611e0
- SHA1
  
  9797fd5870ad84db05678731766df212e93f19fb
- SHA256
  
  32c2f259971bc088c50524880b4a4f3cc1439e30c6d6c891956d386a25bb7b57
- SHA512
  
  5fef1423b4859b23634c03d84cea799eefd23e26764d11759b06e89f05b5cd19d6664fa967311d1dcf7e986dcf8c4b9d45edc9345d8cf5b57c52590681332878
- SSDEEP
  
  384:KmN1/8i9B4VS2LwnciY3ydbC4K7oozETdf+6jQkoRBd0kfKwuH3g70AXGSCyXian:Kmt4oowzdYERAkirQhfPs24
Score

1^/10
behavioral13
- Target
  
  43ea9bb4c0de6540956a4bd2300367582f464806534ed712bf90f058e8db1a2f
- Size
  
  328KB
- MD5
  
  8db947e3fc6fef159cebf9d469fd19f3
- SHA1
  
  6fc67355dd8b89086601eb03dfd2e7bc93b95cf8
- SHA256
  
  43ea9bb4c0de6540956a4bd2300367582f464806534ed712bf90f058e8db1a2f
- SHA512
  
  e0c8be113414169b47c0f3fee8e312c09217f73d841d9600a250aa87a8589b14d0985afd485c834cfd2d19940244b42e817b7207e15e5360d8e024a981592a5e
- SSDEEP
  
  6144:YesJ8EoXmrXnCEc24KYXWc8OG9VvBF2JPVJIGDO6llK:Yes+EoSCekWcxab2JPjIGDN
Score

7^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral14
- Target
  
  4bc9bf90354e02afc581cc3fcc44363ca9b95667be222598569b020619d41112
- Size
  
  24KB
- MD5
  
  5c6c0646cdc41afbab373b8968cd5d0e
- SHA1
  
  f6cc1c0061bc45817fc0f4446a6db7b1226b9725
- SHA256
  
  4bc9bf90354e02afc581cc3fcc44363ca9b95667be222598569b020619d41112
- SHA512
  
  76e09f62206f4a52afa32d1afb6d23916cbe7e867dd5b26c242ce632e6188d13e6e7e01cb70d65592c9fe8b6f80b38daf25442baf4b10dab5a68ac9ca5d259ab
- SSDEEP
  
  384:Yqcke5pqE1xS/1sz0Te4R96I7gYix0QLqKwpTGT76k83pza:Ze5pqoS/1sz0bYi9ix3+KA
Score

1^/10
behavioral15
- Target
  
  4ddd56b9ba0ae2bffe8d7e5d683296db66f1989ffee627459cc3e372a621a20c
- Size
  
  22KB
- MD5
  
  f4d3cf8f72ae49d4680422f355293391
- SHA1
  
  a22bbd140c4ff9aaf6feddb207e20f70df52ec61
- SHA256
  
  4ddd56b9ba0ae2bffe8d7e5d683296db66f1989ffee627459cc3e372a621a20c
- SHA512
  
  164a9cc7c43eec9cf086393679a2e71efd72a8cac2b30430dc163be162903cd3c42e69844a751a898196c2eb4c6d4e4a89dd69d1512f622da68f3e82c4c8cef8
- SSDEEP
  
  384:Q32LDw4T0ijzezK8gt7vARoCw5YkL62pRYodQEG1bu94+Iqu3Ry2Ktm7f+uP:Q3IJTce9RvAR6YkL6KRkngtSgt42uP
Score

3^/10
behavioral16
- Target
  
  58c7d7fb78bdb248ab9ba2b6410729ccd3b5bcfbcec2ff9ddbc688eb8e731f5b
- Size
  
  585KB
- MD5
  
  4bfe537e25a119c4c65d0fb8bd81f3fa
- SHA1
  
  6489ac6ffae4ba43e2e2db1cab87a10d5bad9e75
- SHA256
  
  58c7d7fb78bdb248ab9ba2b6410729ccd3b5bcfbcec2ff9ddbc688eb8e731f5b
- SHA512
  
  3c73c91ef1f94d545bc426113831bb71b5836df4690de31758c1eec92f8cadacd89fe1adbb22d71a613acd8e35477d513df4557733399b6de2241957b5d17992
- SSDEEP
  
  12288:LApvVQd9kOl/OKWzhUrioGUF9edjY4O6YXJcIQeNe7MHcOzaoW0BTyTM:ivVQbkOJODUrf/KYFzXJjQeFc4xBWTM
Score

3^/10
behavioral17
- Target
  
  5a3546962b8632a4fbb4a8d7e857733882685dd71064fd34403227f0ceff8acf
- Size
  
  809KB
- MD5
  
  ce2fb681a49d05db08ca4b73db35ab0b
- SHA1
  
  4ac52f1b21e72bff8af1c71113b88c96c95511c7
- SHA256
  
  5a3546962b8632a4fbb4a8d7e857733882685dd71064fd34403227f0ceff8acf
- SHA512
  
  96097af0e9d0ca6fcb4f3a7d144da129be36905add37b026ae9bc5e6198c8bd8d91003d47b469631a5edd827f9c19d11d7455ea500e73883bf736624db90aaa2
- SSDEEP
  
  12288:638/0lL9s/s/10cYjbOYjG5AWqXNJ9LrZEdytHpzTbJNhkIE4fD9tVYk856WYA2h:088/9GcYjbOBATXPfEduH1fuOA2
Score

7^/10

discovery persistence spyware stealer upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral18
- Target
  
  5b8cebaf9a3ba212c29980c72bad37bde9cbd1598dd5581aaa94b5328b272e32
- Size
  
  235KB
- MD5
  
  3040ce8ca6e0cb79b48a801d800cbc3e
- SHA1
  
  94ce0f4c24002b1724eb378edda74bfca4bcd44a
- SHA256
  
  5b8cebaf9a3ba212c29980c72bad37bde9cbd1598dd5581aaa94b5328b272e32
- SHA512
  
  f0ce02451873fb4f2d71873645f1d4b67ce276e0ac4ee916799fdc923469107ec5589e52d182eeedf8aa9482f31e8e398eb5c99bf92b27f94b7d587f67c1ab2b
- SSDEEP
  
  3072:eTdxklkrGXCjzJWyD5GHCQUAucFOmb7d5R0AwPd3crVUcFM/FGdO:eP27m6OmbWAwOpUcqv
Score

1^/10
behavioral19
- Target
  
  5c14bd03e480126bda27e5a3589b3f0372feea19c298a874e4ee351748563e4e
- Size
  
  104KB
- MD5
  
  84049dfa2c0ca86ee6b9ac83ce243412
- SHA1
  
  1b50c9a09a55d0fa8359540194c5db4519b0d9da
- SHA256
  
  5c14bd03e480126bda27e5a3589b3f0372feea19c298a874e4ee351748563e4e
- SHA512
  
  99381b54a97bd6186e7a6d384ef7912f946d9e75925ab3bb4237a16620a7544e41266623dea216b252e4040920101ce9c6bca4c81f61a57ddfe4ead269b7e524
- SSDEEP
  
  1536:rjVIt3kbIdzsnFeH4rARLOkYS1gr/LlugQnIk:FU3kbId4nFee5y
Score

1^/10
behavioral20
- Target
  
  5e31f354175de6d15da53a0df0d7a4f5a027b4998a794024638eed86240c03af
- Size
  
  63KB
- MD5
  
  65314db798a48aa2a850bb567db3cfc8
- SHA1
  
  1a5693146df0ae970afff2675f79d00f3002a0e8
- SHA256
  
  5e31f354175de6d15da53a0df0d7a4f5a027b4998a794024638eed86240c03af
- SHA512
  
  a7d5feabc388c919fbf01ee160033f3883ac6e7f283db7b68cb88476f0a55ccceb96d68732753ebcfef5b9279faefa1511246f66889ea9b3f7130293bbf80b21
- SSDEEP
  
  1536:/gilo1JF81Hd9dhwp7gbKohOdBTaOjZQmQ5Cd3j534Ro4/WeFlFe8:Ne1JO1Hd9dhwp7gbKohOAOjqsz53CxOa
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral21
- Target
  
  66f08d5d3f32bc74de6b2ccd00182130f08fdf061c3a6003ba18ae947514ca00
- Size
  
  699KB
- MD5
  
  d43417a946bfcb663307bc47aa6b58e9
- SHA1
  
  3620b684007a7c4400a3636b183e734a5c2bafa1
- SHA256
  
  66f08d5d3f32bc74de6b2ccd00182130f08fdf061c3a6003ba18ae947514ca00
- SHA512
  
  b3ae6a3555f6b9ef177b4ad419af0dae75461c6a453bf94664a22dfd5b03a619e86b5aa28fb7535a59608e07571e4687e4cfb4036b38411440c0f21e89c03fd6
- SSDEEP
  
  12288:CPMISJ1OZfMByAK7QFY0s08d/Cw/Kv6lLYA65UQWmQRwbSZqkCSxaXpvojPBFk:OaJ1yfMsyFYy8d6MIkh65UQmGSxpFk
Score

3^/10
behavioral22
- Target
  
  6c5b1dfe45009e90d4cca05a2e8b72c11f460098a16365b01729182c784761c4
- Size
  
  40KB
- MD5
  
  f5ee1bc25611a72c3bf462f514cd5306
- SHA1
  
  76cb2644401f9f002efe572f603ac291365df4b8
- SHA256
  
  6c5b1dfe45009e90d4cca05a2e8b72c11f460098a16365b01729182c784761c4
- SHA512
  
  ce443407438b759124dc9e6a6385e04622ea3503e490748f41c9801bbff791c822780e5bab3a63f5495aeff5bbb0569ec89d2303c331f46c047aba262933ee82
- SSDEEP
  
  768:bWa9YNEaiRrB45Wx8pB0IJc5435bAuOOp1sP+Z6M5o8fhVM:bBME3Vxq0Ru35bASpCP+Z5e8PM
Score

7^/10

adware persistence stealer upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral23
- Target
  
  6cc8f4cef9dc35a064ae576676606179b6973b540a0e33e62bd39f3710a1f698
- Size
  
  6KB
- MD5
  
  ae6cfb28a428ae2a6bce3fc47356e9d1
- SHA1
  
  46c4bd461150ff5ae618278d6fee2dbcc61b9e36
- SHA256
  
  6cc8f4cef9dc35a064ae576676606179b6973b540a0e33e62bd39f3710a1f698
- SHA512
  
  aa681528d02894f65e874c7b5136344a546cce30f044c1cd3b695700f4b5c04bfc4ce148d37b5d9cb107c98eefd1365a17fd9582be4b93003b782bd8d60d057c
- SSDEEP
  
  96:nqJU8SDki87eHKT4cZdGdZENpaR6qaOzOXTH0xWibSib8trXsauE8KIrn:/JR8UKOdZENMILIUr0xsrX78X
Score

1^/10
behavioral24
- Target
  
  79cc928f5b757674fdd933f16dd64e47a58d2d2a01a976e4668960ae6dbcf838
- Size
  
  107KB
- MD5
  
  97fe229652748c4b4480f3c64bfc46a4
- SHA1
  
  4831bb3082fba73b7facdd7ab8f3782e2df5e215
- SHA256
  
  79cc928f5b757674fdd933f16dd64e47a58d2d2a01a976e4668960ae6dbcf838
- SHA512
  
  7d194958fbeab59f4ad828be85854b44a021285a066e5a5ead012bfa1ba06df2e1391a3d0f489a69e783e8c88976f1cb78882b552eb20e9ca00d40c26f97e32b
- SSDEEP
  
  3072:xCvioJ+GIVV0glGUHXX44k/sNjX0N+pUHkv5Mc7ABt:xEqNV05cX44CAXT2Ev5M0ABt
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral25
- Target
  
  7a1641b1c471b4ccf6f37826c21a550fb1bce24a9997c82240caac82ff747f07
- Size
  
  119KB
- MD5
  
  9fa7a5a0655d40849b2f6a31f123d615
- SHA1
  
  7e6be0f03669080198b7a4678b90ef3aa6542bbe
- SHA256
  
  7a1641b1c471b4ccf6f37826c21a550fb1bce24a9997c82240caac82ff747f07
- SHA512
  
  0971d03bbaf43ce46f4f351661a12c57f257571e5ca7bc7e5050732e5785eddf155adbc1ed8a11668b2db8da51dd2b4900e42bb1b8bc23a1c4c22d858f54955d
- SSDEEP
  
  3072:Yu3Yi0YzZpco8fI5BSNJBIz65vBbefQdOV/hvuWWFPJkDa:N3YEvTS/BPwvzWxCDa
Score

1^/10
behavioral26
- Target
  
  8c572f45c61da2276c3182f44475ab36ac6878d8ed3459099f2d2474ede0bd26
- Size
  
  97KB
- MD5
  
  87a55df7c65310ce1738bdc27aebbe59
- SHA1
  
  96f8801ca5d08fe039bad9e1fb16ac6c17b7729a
- SHA256
  
  8c572f45c61da2276c3182f44475ab36ac6878d8ed3459099f2d2474ede0bd26
- SHA512
  
  210da6c8016e962ca1bfee51f374817055286c65fe56ce3583109b6e68312332f7cab561293dfbf83b9ce908271a08050b0d29ac396672f475d915f3656ffdaf
- SSDEEP
  
  3072:7Igr3MwCVEJ+cWNgnUnmnQnsnDeZ9hstkuPzFsm:7IgrCivWgnUnmnQnsnDeGiurH
Score

1^/10
behavioral27
- Target
  
  9a55f3fbb6915aef54a60d249177f989507200445c24662143e6c4d4d7b3ce84
- Size
  
  835KB
- MD5
  
  380c6cb8a313b67cb6f02903086be8c1
- SHA1
  
  459e77c17aca7e5878c390f6624e13c0c6ecd27b
- SHA256
  
  9a55f3fbb6915aef54a60d249177f989507200445c24662143e6c4d4d7b3ce84
- SHA512
  
  0b91f689d6838419600b5dda2ff9c0ddd4efc5dd49e0603576910133bdbfa295b5a2996c293de6e0c0156098f4bb5cd0148ac87977436c063bd2184383b2b7fb
- SSDEEP
  
  12288:rgSn2fveoL+EPF2Y0gYLY+/yKhTm0VG3/HcHj1uVJSQb2uCbaepDjpLQPdO8aw:r1qlKgGgYL9/VhSzQh6JSQ6uCbaQF4O4
Score

7^/10
- Deletes itself
behavioral28
- Target
  
  9d304a516c48eb55d452f1b07963e77452f58d7cbd195b88609dd1bfc3211c1d
- Size
  
  160KB
- MD5
  
  fd0d32457451c0f9565980bfd8a5929b
- SHA1
  
  f2478bc3c7edf7c9214fc353a7addf8df5cf0d99
- SHA256
  
  9d304a516c48eb55d452f1b07963e77452f58d7cbd195b88609dd1bfc3211c1d
- SHA512
  
  07a733174a34eaf1de84106da99ddba509b3f2ed428c77ac3e925461c1bdb9e759e43eb86c522670af93d98d18267a99d985697a21aa4deee6b9d591ee620457
- SSDEEP
  
  3072:ZnZ1Oe/HXWlAW4QS++oU666UsTikoiIyA:ZX/vQMcI
Score

3^/10
behavioral29
- Target
  
  9de72fde393c72c8d621e0c79541c4bb9b840656a6e45f0b46bbb5c7dc10d2dc
- Size
  
  16KB
- MD5
  
  491a19175c735c0330ada341b19f6d76
- SHA1
  
  3eeec2450b1b82172c90f71d552f47013a4e80fa
- SHA256
  
  9de72fde393c72c8d621e0c79541c4bb9b840656a6e45f0b46bbb5c7dc10d2dc
- SHA512
  
  13e80746d1bfb67bcc2c7b10bb339ba279e6f918407a20174579374885d9c70ce1d2e20845e4b0c1ece30882bf6f7d3b1ec98a7935a56c83280d700cdd0a6a5f
- SSDEEP
  
  384:Bv4q1EjAZHLGbCzfe5wGEYt3vGhAznDLOHO:BvZCKHentvG
Score

3^/10
behavioral30
- Target
  
  9e3ac37e4fe247e2e800e03204eaf1a425fe97a7fe7efe8df8a933589b8fd365
- Size
  
  1MB
- MD5
  
  1ed615c82a42f97c81e564a738a1e0ee
- SHA1
  
  b7d826579a4732d02edd776e5f9664be911554da
- SHA256
  
  9e3ac37e4fe247e2e800e03204eaf1a425fe97a7fe7efe8df8a933589b8fd365
- SHA512
  
  86351c2557c8b683a558507422e9fada4b03f7600070a4c9c9483395f678029785eeed98134b26958b55a5ac70f7b89939f5b69d268a927302d8c67260bcd210
- SSDEEP
  
  24576:KpHfHjhraYB17S8RLziyPGotVMg1uAp+WOoJq3Xf3jvH+0pYUGWus3ufJ+90ImSk:KNlrDBrhDGkVdQLWOIqf7tpbbYJxImSk
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral31
- Target
  
  9f7e4792db4b31f0ca10f45f4ab8464454f27aea61543b420130bf96c494da5d
- Size
  
  231KB
- MD5
  
  d2fa4e174ff131436979732faed742f3
- SHA1
  
  dbed2056a723f80f2fcdc5616679e3cb37f372c5
- SHA256
  
  9f7e4792db4b31f0ca10f45f4ab8464454f27aea61543b420130bf96c494da5d
- SHA512
  
  d9ce9d4dc39aa6844caaab7171f506fecfb98fd15381a093b5847c121d54a6ff7f2ed4b89199148763704b9decf1ae125454ea92dfeb6c34d913ed31c89c225f
- SSDEEP
  
  6144:sF+nAqM1SSesHe8DE8Iq0vROklweCp4a+8aX:o+nAR1dHe8DjYspzaX
Score

8^/10

persistence
- Sets DLL path for service in the registry
  persistence
- Loads dropped DLL
- Drops file in System32 directory
behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Modifies Installed Components in the registry

Modifies WinLogon for persistence

Sets file to hidden

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Adds Run key to start application

Modifies WinLogon

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Writes to the Master Boot Record (MBR)

Adds Run key to start application

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

UPX packed file

Adds Run key to start application

Installs/modifies Browser Helper Object

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Deletes itself

UPX packed file

AutoIT Executable

Sets DLL path for service in the registry

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30