Overview

overview

9

Static

static

3

comet.exe

windows7-x64

9

comet.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    comet.exe

  • Size

    3.9MB

  • Sample

    241003-a87y7swblm

  • MD5

    ceda2dc431ae13c9aeabf728d5d092c3

  • SHA1

    c8edf0316050bbf3f174bae89af7f1da5857bf96

  • SHA256

    09220ce3108eebe0a80afe788145918e064df884f6b2c50d0da3863a461a1074

  • SHA512

    78ff3970d2a1831b117a7eebf9f1bc64c1ecf95aff78eee9e5a81d7c52571b1dd4dbb5931cabf559816987e56473a95f86ba581408bc74ba535bb05860f02b9a

  • SSDEEP

    98304:9ysR0ycpLTyD0sx0cB1x6aBW4m7FU48YcJ5:FOycpLTyDD0UXBWtWCc

Score
9/10
discoveryevasion

Malware Config

Targets

    • Target

      comet.exe

    • Size

      3.9MB

    • MD5

      ceda2dc431ae13c9aeabf728d5d092c3

    • SHA1

      c8edf0316050bbf3f174bae89af7f1da5857bf96

    • SHA256

      09220ce3108eebe0a80afe788145918e064df884f6b2c50d0da3863a461a1074

    • SHA512

      78ff3970d2a1831b117a7eebf9f1bc64c1ecf95aff78eee9e5a81d7c52571b1dd4dbb5931cabf559816987e56473a95f86ba581408bc74ba535bb05860f02b9a

    • SSDEEP

      98304:9ysR0ycpLTyD0sx0cB1x6aBW4m7FU48YcJ5:FOycpLTyDD0UXBWtWCc

    Score
    9/10
    discoveryevasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks