darkcomet | bd1987c7ab8b9fd05abe464f4179118a5422cb07b22ad6bb2ae0cb742cbdd46e

Sharing

Copy URL

Twitter E-mail

General

Target

bd1987c7ab8b9fd05abe464f4179118a5422cb07b22ad6bb2ae0cb742cbdd46e
Size

329KB
MD5

6e44d3f2f4078870e77a0d7f2686aa1d
SHA1

a21ba7eae0310d818c0f19220903b2afca5cc30f
SHA256

bd1987c7ab8b9fd05abe464f4179118a5422cb07b22ad6bb2ae0cb742cbdd46e
SHA512

06462f8d95311b8f0b4cc360ed10953a5bca0e9fced2e4960bbfb782fc0f262ea2d658b6bc97c663774683cbee8360f56ab7ee998c55b7c510bb64b2a05308a6
SSDEEP

6144:p9SJWTjsROlzjFgKcUF+ROlUaDrShBFa6H/isdho1Wj7Xb71tV9qO0qnJEza8CM5:p9SJYkOlzDcGFLavtfisdhombd9qMnJe

Score

10^/10

upx sazan darkcomet

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

dreamy-wildflower-77334.pktriot.net:22952

Mutex

DC_MUTEX-3E3TFM5

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
ZxS92vJY80dM
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet family
darkcomet

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
static1/unpack001/803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da.exe

Files

bd1987c7ab8b9fd05abe464f4179118a5422cb07b22ad6bb2ae0cb742cbdd46e
.zip

Password: infected
803acc94c62662e15c74813bb25573c8ca409906bcfae8c4aa47d738934e02da.exe
.exe windows:4 windows x86 arch:x86

36923b75c0739816377afd1606b57107

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

AnimateWindow
EnumDisplayMonitors
GetMonitorInfoA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

lstrcpy
WriteProcessMemory
WriteFile
WinExec
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQuery
VirtualProtectEx
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
VerLanguageNameA
UnmapViewOfFile
TerminateProcess
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetThreadContext
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadProcessMemory
ReadFile
PeekNamedPipe
OpenProcess
MultiByteToWideChar
MulDiv
MoveFileA
MapViewOfFile
LockResource
LocalFileTimeToFileTime
LocalAlloc
LoadResource
LoadLibraryA
LeaveCriticalSection
IsBadReadPtr
InitializeCriticalSection
HeapFree
HeapAlloc
GlobalUnlock
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetVersion
GetUserDefaultLangID
GetTickCount
GetThreadLocale
GetThreadContext
GetTempPathA
GetSystemPowerStatus
GetSystemDirectoryA
GetStdHandle
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileTime
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
ExitProcess
EnumResourceNamesA
EnumCalendarInfoA
EnterCriticalSection
DosDateTimeToFileTime
DeleteFileA
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessA
CreatePipe
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CompareStringA
CloseHandle
Beep
Sleep
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess

advapi32

RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyA
RegFlushKey
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueA
LookupPrivilegeNameA
LookupPrivilegeDisplayNameA
LookupAccountSidA
IsValidSid
GetUserNameA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetCurrentHwProfileA
AdjustTokenPrivileges
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
EnumServicesStatusA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
IsValidSid

wsock32

__WSAFDIsSet
WSACleanup
WSAStartup
WSAGetLastError
gethostname
getservbyname
gethostbyname
gethostbyaddr
socket
shutdown
sendto
send
select
recv
htons
listen
ioctlsocket
inet_ntoa
inet_addr
htons
getsockname
connect
closesocket
bind

combase

CoTaskMemFree
StringFromCLSID
CoTaskMemFree
CLSIDFromProgID
ProgIDFromCLSID
StringFromCLSID
CoCreateInstance
CoUninitialize

shell32

ShellExecuteEx
ShellExecuteA
SHGetFileInfo
SHFileOperation
DragQueryFile
SHGetSpecialFolderLocation
SHGetPathFromIDList
SHEmptyRecycleBinA
ShellExecuteA

oleaut32

GetErrorInfo
GetActiveObject
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
VariantCopy

ole32

CoInitialize
IsEqualGUID
IsEqualGUID

urlmon

URLDownloadToFileA
URLDownloadToFileA

comctl32

_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
ImageList_Add

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpQueryInfoA
FtpPutFileA
FtpPutFileA

winmm

waveInUnprepareHeader
waveInStart
waveInReset
waveInPrepareHeader
waveInOpen
waveInClose
waveInAddBuffer
PlaySoundA
mciSendStringA
waveInOpen

netapi32

Netbios
NetApiBufferFree
NetShareGetInfo
NetShareEnum
Netbios

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipFree

msacm32

acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamConvert
acmStreamReset
acmStreamSize
acmStreamClose
acmStreamOpen
acmStreamSize

ntdll

NtQuerySystemInformation
NtUnmapViewOfSection
NtUnmapViewOfSection
NtQuerySystemInformation

ws2_32

WSAIoctl
WSAIoctl
send

shfolder

SHGetFolderPathA
SHGetFolderPathA

avicap32

capGetDriverDescriptionA
capGetDriverDescriptionA

gdi32

SaveDC

Sections

UPX0
Size: 476KB - Virtual size: 476KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

UPX1
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

36923b75c0739816377afd1606b57107

Headers

File Characteristics

Imports

user32

version

kernel32

advapi32

wsock32

combase

shell32

oleaut32

ole32

urlmon

comctl32

wininet

winmm

netapi32

gdiplus

msacm32

ntdll

ws2_32

shfolder

avicap32

gdi32

Sections

UPX0 Size: 476KB - Virtual size: 476KB

UPX1 Size: 248KB - Virtual size: 248KB

.rsrc Size: 15KB - Virtual size: 15KB

UPX0
Size: 476KB - Virtual size: 476KB

UPX1
Size: 248KB - Virtual size: 248KB

.rsrc
Size: 15KB - Virtual size: 15KB