Overview

overview

10

Static

static

3

3b4b520583...dN.exe

windows7-x64

10

3b4b520583...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b4b5205831d94bb1975627f70e52acfbe84464cd38263eeb6a60de2582c5efdN

  • Size

    574KB

  • Sample

    241029-mvyvlavclb

  • MD5

    5d2a655b4568181ed1944d5a7259e540

  • SHA1

    d3f1b3f94a6dea9075a03811f222e7ad9b377bd2

  • SHA256

    3b4b5205831d94bb1975627f70e52acfbe84464cd38263eeb6a60de2582c5efd

  • SHA512

    9b31267129ce95265215b96080dd81709faea2cda61d258cadb63048f14d1b0ef6a9e5fcbe375b5bd63c49882ce26cc1e77ac2227e6d6aaab54585435da1fa16

  • SSDEEP

    12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3Hdsubv:zFhWAfn22m0eD1GPz8HdxL

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      3b4b5205831d94bb1975627f70e52acfbe84464cd38263eeb6a60de2582c5efdN

    • Size

      574KB

    • MD5

      5d2a655b4568181ed1944d5a7259e540

    • SHA1

      d3f1b3f94a6dea9075a03811f222e7ad9b377bd2

    • SHA256

      3b4b5205831d94bb1975627f70e52acfbe84464cd38263eeb6a60de2582c5efd

    • SHA512

      9b31267129ce95265215b96080dd81709faea2cda61d258cadb63048f14d1b0ef6a9e5fcbe375b5bd63c49882ce26cc1e77ac2227e6d6aaab54585435da1fa16

    • SSDEEP

      12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3Hdsubv:zFhWAfn22m0eD1GPz8HdxL

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks