General

  • Target

    BlackMail.exe

  • Size

    923KB

  • Sample

    240810-wepresvarg

  • MD5

    cc9acc9e7253ddefeea935cf0e706272

  • SHA1

    f2fa28d60ddae4a90747bec861e6b4ba6e9486a9

  • SHA256

    52a29885926d3bfcfa43bdf9cedde199ad8c20566f60b432cea5b65d82f557f5

  • SHA512

    4aab367331b9dd69d7ae5b520718542f260e1630f291728b19e682d5e737d3428441df65c58946d48e806906566a05e823b5a87ce337bc4923c29d3b87092c64

  • SSDEEP

    12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hI82gG:aZ1xuVVjfFoynPaVBUR8f+kN10EBpe

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

april-came.gl.at.ply.gg:61838

Mutex

DC_MUTEX-6ZL3QWE

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    iogNsu6a0J2i

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Targets

    • Target

      BlackMail.exe

    • Size

      923KB

    • MD5

      cc9acc9e7253ddefeea935cf0e706272

    • SHA1

      f2fa28d60ddae4a90747bec861e6b4ba6e9486a9

    • SHA256

      52a29885926d3bfcfa43bdf9cedde199ad8c20566f60b432cea5b65d82f557f5

    • SHA512

      4aab367331b9dd69d7ae5b520718542f260e1630f291728b19e682d5e737d3428441df65c58946d48e806906566a05e823b5a87ce337bc4923c29d3b87092c64

    • SSDEEP

      12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hI82gG:aZ1xuVVjfFoynPaVBUR8f+kN10EBpe

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies security service

    • Windows security bypass

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks