Overview

overview

10

Static

static

3

19c9322551...bf.exe

windows7-x64

10

19c9322551...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19c9322551012d00654a336a4fe26e9db7b49f2e604cf8bc4f5403936715ffbf

  • Size

    574KB

  • Sample

    241011-yf8a9szgjf

  • MD5

    52053488556582bcd1276d266e1b48f2

  • SHA1

    069ecd50ad51330a4b6b7e0865db9f63d25c1ebe

  • SHA256

    19c9322551012d00654a336a4fe26e9db7b49f2e604cf8bc4f5403936715ffbf

  • SHA512

    c82692d94731d4d4e189c01f05d92d077bbc19429f64eefce70f63e63ea44695c5ed878bb5cb0f60acaad11ba02f31fadbf25ffde263b159b696cdeeb9229147

  • SSDEEP

    12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3HdsubX:zFhWAfn22m0eD1GPz8HdxD

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      19c9322551012d00654a336a4fe26e9db7b49f2e604cf8bc4f5403936715ffbf

    • Size

      574KB

    • MD5

      52053488556582bcd1276d266e1b48f2

    • SHA1

      069ecd50ad51330a4b6b7e0865db9f63d25c1ebe

    • SHA256

      19c9322551012d00654a336a4fe26e9db7b49f2e604cf8bc4f5403936715ffbf

    • SHA512

      c82692d94731d4d4e189c01f05d92d077bbc19429f64eefce70f63e63ea44695c5ed878bb5cb0f60acaad11ba02f31fadbf25ffde263b159b696cdeeb9229147

    • SSDEEP

      12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3HdsubX:zFhWAfn22m0eD1GPz8HdxD

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks