Overview

overview

10

Static

static

3

229ed40d55...85.exe

windows7-x64

10

229ed40d55...85.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    229ed40d552df7f6945c547a76088f85

  • Size

    734KB

  • Sample

    231225-qz1rjadhd2

  • MD5

    229ed40d552df7f6945c547a76088f85

  • SHA1

    eb1ee94471caf81a6f6c3f40b9b3df7aa493bee1

  • SHA256

    6dc67d242dcdf78000162614b046c9ca0282aa502574324c8de8ab7acbe420b6

  • SHA512

    0d706f7ffe12b859142c2719c14ff82cdf780fa435dff9856e108efa1f9594b8b5dda4424fdd2b91e5cc9c412fa72196882760a4bc86dfa8d5929580c9121bd1

  • SSDEEP

    12288:JaXTluCLqVRUQaBA/3oHET3PVt7bkstj6CcMii7rAi:4XxbOnUQaBAwHuPVt7bkcj9c1m

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      229ed40d552df7f6945c547a76088f85

    • Size

      734KB

    • MD5

      229ed40d552df7f6945c547a76088f85

    • SHA1

      eb1ee94471caf81a6f6c3f40b9b3df7aa493bee1

    • SHA256

      6dc67d242dcdf78000162614b046c9ca0282aa502574324c8de8ab7acbe420b6

    • SHA512

      0d706f7ffe12b859142c2719c14ff82cdf780fa435dff9856e108efa1f9594b8b5dda4424fdd2b91e5cc9c412fa72196882760a4bc86dfa8d5929580c9121bd1

    • SSDEEP

      12288:JaXTluCLqVRUQaBA/3oHET3PVt7bkstj6CcMii7rAi:4XxbOnUQaBAwHuPVt7bkcj9c1m

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks