Overview

overview

10

Static

static

1

7a80c67ca3...1N.exe

windows7-x64

10

7a80c67ca3...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a80c67ca3d339e6e92e35ece33b68607735467ef2e39d33e59b780328f17b61N.exe

  • Size

    3.9MB

  • Sample

    241123-jd9zraxnar

  • MD5

    3d84949af2d5bd0e27c5f0f348a57220

  • SHA1

    15685d4c0ef9a8913573ddb0bf4969b8e55c7933

  • SHA256

    7a80c67ca3d339e6e92e35ece33b68607735467ef2e39d33e59b780328f17b61

  • SHA512

    476da33540a0094475d7e91a2b2a0d0f2356c0d048b8fad827671ab966db4cbfd333a04078f57ed45ef8f2c613e689f3ab2dfd999293e9f8ccd210d3b3d9b3a4

  • SSDEEP

    98304:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5Cl:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBl

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      7a80c67ca3d339e6e92e35ece33b68607735467ef2e39d33e59b780328f17b61N.exe

    • Size

      3.9MB

    • MD5

      3d84949af2d5bd0e27c5f0f348a57220

    • SHA1

      15685d4c0ef9a8913573ddb0bf4969b8e55c7933

    • SHA256

      7a80c67ca3d339e6e92e35ece33b68607735467ef2e39d33e59b780328f17b61

    • SHA512

      476da33540a0094475d7e91a2b2a0d0f2356c0d048b8fad827671ab966db4cbfd333a04078f57ed45ef8f2c613e689f3ab2dfd999293e9f8ccd210d3b3d9b3a4

    • SSDEEP

      98304:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5Cl:8lX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBl

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks