Overview

overview

10

Static

static

10

c52d6bfcb1...67.exe

windows7-x64

10

c52d6bfcb1...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c52d6bfcb18b48ce0976886fc1c60967

  • Size

    930KB

  • Sample

    240313-gzslgsef7y

  • MD5

    c52d6bfcb18b48ce0976886fc1c60967

  • SHA1

    da6575713f50dae6e3ea4fac5aaf0d983c351171

  • SHA256

    6dbc41a48a41c991800d78eb2bd7231512830620880febda4a17e75c4f438a56

  • SHA512

    dc764e1d42bf9a74b5ac14be8ba01c1dfcf013456b2d403bf0e3616a440a5f124fde0909f207eeb02de3ebdad5e65425fb7f86ac204c6e3090ceb8973a19e0e0

  • SSDEEP

    24576:KZ1xuVVjfFoynPaVBUR8f+kN10EBxYAGrW:aQDgok30bAz

Score
10/10
darkcometguest16discoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

jesusiscool.no-ip.biz:1604

Mutex

DC_MUTEX-2MFKDUD

Attributes
  • gencode

    hR4kwDNMtXyi

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      c52d6bfcb18b48ce0976886fc1c60967

    • Size

      930KB

    • MD5

      c52d6bfcb18b48ce0976886fc1c60967

    • SHA1

      da6575713f50dae6e3ea4fac5aaf0d983c351171

    • SHA256

      6dbc41a48a41c991800d78eb2bd7231512830620880febda4a17e75c4f438a56

    • SHA512

      dc764e1d42bf9a74b5ac14be8ba01c1dfcf013456b2d403bf0e3616a440a5f124fde0909f207eeb02de3ebdad5e65425fb7f86ac204c6e3090ceb8973a19e0e0

    • SSDEEP

      24576:KZ1xuVVjfFoynPaVBUR8f+kN10EBxYAGrW:aQDgok30bAz

    Score
    10/10
    darkcometguest16rattrojandiscovery

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks