Overview

overview

10

Static

static

5

98eea43fdc...fN.exe

windows7-x64

10

98eea43fdc...fN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98eea43fdcd2e6ca209c33f5ede4d38ec4fbe9e03134fa5d6e2e35138cddd46fN

  • Size

    559KB

  • Sample

    241106-157gda1nbr

  • MD5

    aa94785e80b031c008cd48a2ec031700

  • SHA1

    3d112a45f1ed4545389316fa46bab4aae713f741

  • SHA256

    98eea43fdcd2e6ca209c33f5ede4d38ec4fbe9e03134fa5d6e2e35138cddd46f

  • SHA512

    14a1b393d29a0f05014d200084c4742c627a23ebe2bbdea804f57382672f4cf1b2202c9c5421dae0860d5492dd5b860e28440ad930117626271b08ee98cdea6c

  • SSDEEP

    12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSd:COEzCFaCpAYJbwzOqPUlvOsmi9c8SlH

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      98eea43fdcd2e6ca209c33f5ede4d38ec4fbe9e03134fa5d6e2e35138cddd46fN

    • Size

      559KB

    • MD5

      aa94785e80b031c008cd48a2ec031700

    • SHA1

      3d112a45f1ed4545389316fa46bab4aae713f741

    • SHA256

      98eea43fdcd2e6ca209c33f5ede4d38ec4fbe9e03134fa5d6e2e35138cddd46f

    • SHA512

      14a1b393d29a0f05014d200084c4742c627a23ebe2bbdea804f57382672f4cf1b2202c9c5421dae0860d5492dd5b860e28440ad930117626271b08ee98cdea6c

    • SSDEEP

      12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSd:COEzCFaCpAYJbwzOqPUlvOsmi9c8SlH

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks