Overview

overview

10

Static

static

10

prevmkali.exe

windows7-x64

10

prevmkali.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99a28e7012cf6dffd608f0947329044e161747e9eedf5a61ddb7245edccc3982

  • Size

    246KB

  • Sample

    240413-zrfwtsch6z

  • MD5

    6ccd4a9dcbc5a64036149722d84ac93a

  • SHA1

    23f9d578d279f196e3026728e2503283393ccf3b

  • SHA256

    aecef6d3695122c47aa63b8987aad0155c36b54016a3bab9b59c216ac8e53027

  • SHA512

    62fac7b6dce8125a6f5f881dc23fb2427d7e8d1ed4b38f29ccd6b39f998330aed6beb7f66e353906765b40791b979a2937b3f1427bd99b4bd58d94869871ddc1

  • SSDEEP

    3072:wMO9rMIs3KqRzLDrp2ITv/9Hanh3KGn5l4OJ9YlMa+ESyF9h+6HBUc673rat0+bq:wj9iKqR7HT/9lG5tJ9CMw4EdM7at0+ZQ

Score
10/10
darkcometguest16evasionrattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6.tcp.us-cal-1.ngrok.io:12638

127.0.0.1:1337
Mutex

DC_MUTEX-RSWN5YL

Attributes
  • gencode

    7gEewe3dp4fF

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      prevmkali.exe

    • Size

      251KB

    • MD5

      e556b66a52ae28b3c877a9f3c419c5e3

    • SHA1

      3a71dfde7b64c92cca1a023d0c807364d7d4cc1f

    • SHA256

      1993dacf9211a1dab3c7cca176add0714f3061a7c9cb2edaacd31448c16c746a

    • SHA512

      cd8b4a5ba819848cf48b8e59da0099324b06c54bb913381720e612e003a47cef583b4f96947d70a40e41445a802d4368835d339c0a2a2b5c7b91bfbd604df277

    • SSDEEP

      6144:TdcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37k1:TdcW7KEZlPzCy37

    Score
    10/10
    darkcometguest16evasionrattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks