Overview

overview

10

Static

static

10

yooo.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yooo.exe

  • Size

    658KB

  • Sample

    241117-d7hvgazgrf

  • MD5

    677d14c29be05629a77415b842492b76

  • SHA1

    6b491eca627cb457414262cc9d417fab81b4db67

  • SHA256

    e65037238450eabc137cd356dcc62b16db53db61531154e64ca00acfd00e0213

  • SHA512

    de64f10a8c41488d3c88bd5edeaf530954a762a0ee1b49873b82a45604a7e7eb91c18569f8dec23e1129f9b52a312b9992508d948e60ee85dc71f2d498285f3f

  • SSDEEP

    12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h3:+Z1xuVVjfFoynPaVBUR8f+kN10EB5

Score
10/10
darkcometguest16_mindiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

10.211.55.25:1604

Mutex

DCMIN_MUTEX-410US0Y

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    41iAjvfv0Zir

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Targets

    • Target

      yooo.exe

    • Size

      658KB

    • MD5

      677d14c29be05629a77415b842492b76

    • SHA1

      6b491eca627cb457414262cc9d417fab81b4db67

    • SHA256

      e65037238450eabc137cd356dcc62b16db53db61531154e64ca00acfd00e0213

    • SHA512

      de64f10a8c41488d3c88bd5edeaf530954a762a0ee1b49873b82a45604a7e7eb91c18569f8dec23e1129f9b52a312b9992508d948e60ee85dc71f2d498285f3f

    • SSDEEP

      12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h3:+Z1xuVVjfFoynPaVBUR8f+kN10EB5

    Score
    10/10
    darkcometguest16_mindiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks