General

  • Target

    f092b714c9c93032e53a29f294f1f32171b94c6dbea73e520ceca54b4924d302N

  • Size

    3.9MB

  • Sample

    241106-em4rwavenn

  • MD5

    708d7d61f8ec91d35b06f3aa5c12c100

  • SHA1

    ea679faff2646731ab2312627457cb592860fb58

  • SHA256

    f092b714c9c93032e53a29f294f1f32171b94c6dbea73e520ceca54b4924d302

  • SHA512

    5f298ba3f2dbcd0a756d943b3e5acca20294325e901718e11327df2ad6aeed2b24245be2dc925426a9f52d2fc8bba739c615aa8ac24fbb4663cae6b42708a720

  • SSDEEP

    98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5C4:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmB4

Malware Config

Targets

    • Target

      f092b714c9c93032e53a29f294f1f32171b94c6dbea73e520ceca54b4924d302N

    • Size

      3.9MB

    • MD5

      708d7d61f8ec91d35b06f3aa5c12c100

    • SHA1

      ea679faff2646731ab2312627457cb592860fb58

    • SHA256

      f092b714c9c93032e53a29f294f1f32171b94c6dbea73e520ceca54b4924d302

    • SHA512

      5f298ba3f2dbcd0a756d943b3e5acca20294325e901718e11327df2ad6aeed2b24245be2dc925426a9f52d2fc8bba739c615aa8ac24fbb4663cae6b42708a720

    • SSDEEP

      98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5C4:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmB4

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks