Overview

overview

10

Static

static

3

cb88956b76...08.exe

windows7-x64

10

cb88956b76...08.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb88956b765445b5b073e6934c7eab08

  • Size

    763KB

  • Sample

    240315-qsfssahd9s

  • MD5

    cb88956b765445b5b073e6934c7eab08

  • SHA1

    be988a17dd322418deb21e497c882035654eeb66

  • SHA256

    e040de0e7f4d613ed9cab462ec0ffa944b6e5ca125f971c4bef5a71195ede57a

  • SHA512

    93a8e416018c9e165530b2152a450d7b14c4e79e8dd5c245139c57bae09da09ced4b89b5041ad2c280e309fa15af2f3261a9496bdd31ff61505d527b8c61ec4e

  • SSDEEP

    12288:aGKLKkc69/hWT9lAksP12EgVgcruncSOg2umW1+nib2C08vw/wSaTwIzP+lN0J:adLKkjWvANP1PAJ0Auf+G2l8Owt5zP+e

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      cb88956b765445b5b073e6934c7eab08

    • Size

      763KB

    • MD5

      cb88956b765445b5b073e6934c7eab08

    • SHA1

      be988a17dd322418deb21e497c882035654eeb66

    • SHA256

      e040de0e7f4d613ed9cab462ec0ffa944b6e5ca125f971c4bef5a71195ede57a

    • SHA512

      93a8e416018c9e165530b2152a450d7b14c4e79e8dd5c245139c57bae09da09ced4b89b5041ad2c280e309fa15af2f3261a9496bdd31ff61505d527b8c61ec4e

    • SSDEEP

      12288:aGKLKkc69/hWT9lAksP12EgVgcruncSOg2umW1+nib2C08vw/wSaTwIzP+lN0J:adLKkjWvANP1PAJ0Auf+G2l8Owt5zP+e

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks