Overview

overview

10

Static

static

5

35b36c3203...3N.exe

windows7-x64

10

35b36c3203...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35b36c3203335b01c3f1c0bdcd40bda5a0135018092dcc30486aca8318499193N

  • Size

    3.8MB

  • Sample

    241029-axgymsynfq

  • MD5

    a8fa05ba3069ff13f3973155f2ee5870

  • SHA1

    26cd033fe9d42fd61c35beeeb63ef31399272491

  • SHA256

    35b36c3203335b01c3f1c0bdcd40bda5a0135018092dcc30486aca8318499193

  • SHA512

    3ec0fa1fd5a40f5e3053899fadddfa20611e84a00c0ce4edb6490d8adc99a520b2d2d5c68a48ff3cdfb71c41e8ce8d939959347e03f8b1f4d470d320514f2af3

  • SSDEEP

    98304:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qg:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSi6

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      35b36c3203335b01c3f1c0bdcd40bda5a0135018092dcc30486aca8318499193N

    • Size

      3.8MB

    • MD5

      a8fa05ba3069ff13f3973155f2ee5870

    • SHA1

      26cd033fe9d42fd61c35beeeb63ef31399272491

    • SHA256

      35b36c3203335b01c3f1c0bdcd40bda5a0135018092dcc30486aca8318499193

    • SHA512

      3ec0fa1fd5a40f5e3053899fadddfa20611e84a00c0ce4edb6490d8adc99a520b2d2d5c68a48ff3cdfb71c41e8ce8d939959347e03f8b1f4d470d320514f2af3

    • SSDEEP

      98304:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qg:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSi6

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks