Overview

overview

10

Static

static

3

21269e4446...b6.exe

windows7-x64

10

21269e4446...b6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21269e444697a812fb13d20551beccb6

  • Size

    902KB

  • Sample

    231231-afsntabefm

  • MD5

    21269e444697a812fb13d20551beccb6

  • SHA1

    33b88c3d3c90083b5d622956d85bf4fc4cb2d160

  • SHA256

    f09ffc92989fb0c88d7ac90dab82fc3affc6f933fb82ba85eb251e8a892d0dc3

  • SHA512

    5518d3e5bb177aa1398a6d1162aab6f00d1c7fbf247ca4d9aacbc5c21545ff22f04661951aca0457b86facb0b5131ff52dcea4ca725a66d48727e46933a8d6f4

  • SSDEEP

    12288:FvM79G/eol39oqzuyOVpjTjUl7kCTWvgkppB/TIwJAeaVcZ2xFlWi:iM5uytBavgKtcxF5

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      21269e444697a812fb13d20551beccb6

    • Size

      902KB

    • MD5

      21269e444697a812fb13d20551beccb6

    • SHA1

      33b88c3d3c90083b5d622956d85bf4fc4cb2d160

    • SHA256

      f09ffc92989fb0c88d7ac90dab82fc3affc6f933fb82ba85eb251e8a892d0dc3

    • SHA512

      5518d3e5bb177aa1398a6d1162aab6f00d1c7fbf247ca4d9aacbc5c21545ff22f04661951aca0457b86facb0b5131ff52dcea4ca725a66d48727e46933a8d6f4

    • SSDEEP

      12288:FvM79G/eol39oqzuyOVpjTjUl7kCTWvgkppB/TIwJAeaVcZ2xFlWi:iM5uytBavgKtcxF5

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks