General

  • Target

    yle.exe

  • Size

    658KB

  • Sample

    240727-snbpdaycle

  • MD5

    36f32d50a76c85e4e53815019095db18

  • SHA1

    88e9a942bcaeb6aa641748b3acba44063732a784

  • SHA256

    20ce41d2b94dfa4efcdb3e7d87a235e7eff9afe46496d7724ec74b1e6cc63f5a

  • SHA512

    12e1cf81067edbea489d2308f428f1d9dffbdf627bd0d931ff88faecbd6fcaa356305eeae7a7ec7ed356886257775949eb389606254229b23c404895dc099bac

  • SSDEEP

    12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hN:GZ1xuVVjfFoynPaVBUR8f+kN10EBX

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

7.tcp.eu.ngrok.io:1121

Mutex

DC_MUTEX-SEVF84J

Attributes
  • gencode

    PQAtJlbrDr7F

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      yle.exe

    • Size

      658KB

    • MD5

      36f32d50a76c85e4e53815019095db18

    • SHA1

      88e9a942bcaeb6aa641748b3acba44063732a784

    • SHA256

      20ce41d2b94dfa4efcdb3e7d87a235e7eff9afe46496d7724ec74b1e6cc63f5a

    • SHA512

      12e1cf81067edbea489d2308f428f1d9dffbdf627bd0d931ff88faecbd6fcaa356305eeae7a7ec7ed356886257775949eb389606254229b23c404895dc099bac

    • SSDEEP

      12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hN:GZ1xuVVjfFoynPaVBUR8f+kN10EBX

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks