Overview

overview

10

Static

static

3

0f6310c3c3...2f.exe

windows7-x64

10

0f6310c3c3...2f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0f6310c3c3c5e1a85d0078a43c6eb62f

  • Size

    882KB

  • Sample

    231230-fnkwtsacfp

  • MD5

    0f6310c3c3c5e1a85d0078a43c6eb62f

  • SHA1

    38524ea92dcb2813650f0c822ff2b268603ff499

  • SHA256

    35a3124060ee578c7cdeea4d46411a977d2d6b1484baa480b1be1e2e867b29ab

  • SHA512

    ebe2a1f6152ee5a8f8f9c900344478a4fd3835d8ffc82d6a0095377b2986bb25ceaa86384b8b8a045e07e4867ec5ca14de6b17d2d485d90345089e9713323894

  • SSDEEP

    12288:KLWZOKZwd1DVScATokBP9qTc3OujOpzGcPwj8R36nUBzD/YyGZRJ+g0i1yIge:KLWW5bATXVqTEOzF6+DwDLJ+Ji1yIge

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      0f6310c3c3c5e1a85d0078a43c6eb62f

    • Size

      882KB

    • MD5

      0f6310c3c3c5e1a85d0078a43c6eb62f

    • SHA1

      38524ea92dcb2813650f0c822ff2b268603ff499

    • SHA256

      35a3124060ee578c7cdeea4d46411a977d2d6b1484baa480b1be1e2e867b29ab

    • SHA512

      ebe2a1f6152ee5a8f8f9c900344478a4fd3835d8ffc82d6a0095377b2986bb25ceaa86384b8b8a045e07e4867ec5ca14de6b17d2d485d90345089e9713323894

    • SSDEEP

      12288:KLWZOKZwd1DVScATokBP9qTc3OujOpzGcPwj8R36nUBzD/YyGZRJ+g0i1yIge:KLWW5bATXVqTEOzF6+DwDLJ+Ji1yIge

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks