Overview

overview

10

Static

static

10

prevmkali.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    prevmkali.exe

  • Size

    251KB

  • Sample

    240413-zfq8eshf23

  • MD5

    e556b66a52ae28b3c877a9f3c419c5e3

  • SHA1

    3a71dfde7b64c92cca1a023d0c807364d7d4cc1f

  • SHA256

    1993dacf9211a1dab3c7cca176add0714f3061a7c9cb2edaacd31448c16c746a

  • SHA512

    cd8b4a5ba819848cf48b8e59da0099324b06c54bb913381720e612e003a47cef583b4f96947d70a40e41445a802d4368835d339c0a2a2b5c7b91bfbd604df277

  • SSDEEP

    6144:TdcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37k1:TdcW7KEZlPzCy37

Score
10/10
darkcometguest16evasionrattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6.tcp.us-cal-1.ngrok.io:12638

127.0.0.1:1337
Mutex

DC_MUTEX-RSWN5YL

Attributes
  • gencode

    7gEewe3dp4fF

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      prevmkali.exe

    • Size

      251KB

    • MD5

      e556b66a52ae28b3c877a9f3c419c5e3

    • SHA1

      3a71dfde7b64c92cca1a023d0c807364d7d4cc1f

    • SHA256

      1993dacf9211a1dab3c7cca176add0714f3061a7c9cb2edaacd31448c16c746a

    • SHA512

      cd8b4a5ba819848cf48b8e59da0099324b06c54bb913381720e612e003a47cef583b4f96947d70a40e41445a802d4368835d339c0a2a2b5c7b91bfbd604df277

    • SSDEEP

      6144:TdcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37k1:TdcW7KEZlPzCy37

    Score
    10/10
    darkcometguest16evasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks