darkcomet | 803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da | Triage

Sharing

General

Target

803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da.exe
Size

743KB
Sample

240412-bryjwaed2z
MD5

637f6de5f408e94ca5c12a1ed019518e
SHA1

dcf8f4b29b329d9d1a0de46dadbf80a38256c87b
SHA256

803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da
SHA512

772655aa6ea0fa2fa7640829ffd2b0d4c1b20e34f23cdfffb0fcdc6ffb691ace29c75efa7d186c38dc63288ce67b4537a2c95208268401d3d20065a33ec9a424
SSDEEP

12288:XcH9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkDG/:8Z1xuVVjfFoynPaVBUR8f+kN10EH

Score

10^/10

darkcomet sazan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

dreamy-wildflower-77334.pktriot.net:22952

Mutex

DC_MUTEX-3E3TFM5

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
ZxS92vJY80dM
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Targets

- Target
  
  803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da.exe
- Size
  
  743KB
- MD5
  
  637f6de5f408e94ca5c12a1ed019518e
- SHA1
  
  dcf8f4b29b329d9d1a0de46dadbf80a38256c87b
- SHA256
  
  803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da
- SHA512
  
  772655aa6ea0fa2fa7640829ffd2b0d4c1b20e34f23cdfffb0fcdc6ffb691ace29c75efa7d186c38dc63288ce67b4537a2c95208268401d3d20065a33ec9a424
- SSDEEP
  
  12288:XcH9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkDG/:8Z1xuVVjfFoynPaVBUR8f+kN10EH
Score

1^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

upxsazandarkcomet

behavioral1

behavioral2