Overview

overview

10

Static

static

10

Bloxstrap-v2.8.1.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bloxstrap-v2.8.1.exe

  • Size

    11.8MB

  • Sample

    241123-xwferaxqhn

  • MD5

    e69a7ea8d0eb02161014099e87649d41

  • SHA1

    cd55596fc4e8de9c63e0558b767e9cdd33fb0074

  • SHA256

    964b9a59015e847d1dfcb014f494ebf73c66dcad41d8acfe1772de0ae7cf5ea7

  • SHA512

    cff49a2db8f18f9c3031062667cdd989ae6ec95c44d34bb8b8bbddfcf2f44ce8affc1a55eb80969dab834152b25cb05903792688ebe94fcd0393b0f5439baf3d

  • SSDEEP

    98304:SFqZ+pv3Tscod5DFasb/r5vGWD3EOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlLO:SFqZ+pLscVsb/r5vGlObAbN0IQ

Score
10/10
darkcometguest16discoveryrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

saw-shirts.gl.at.ply.gg:4164

Mutex

DC_MUTEX-CKC2QC9

Attributes
  • InstallPath

    Bloxstrap.exe

  • gencode

    g4KLit9u75vm

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Targets

    • Target

      Bloxstrap-v2.8.1.exe

    • Size

      11.8MB

    • MD5

      e69a7ea8d0eb02161014099e87649d41

    • SHA1

      cd55596fc4e8de9c63e0558b767e9cdd33fb0074

    • SHA256

      964b9a59015e847d1dfcb014f494ebf73c66dcad41d8acfe1772de0ae7cf5ea7

    • SHA512

      cff49a2db8f18f9c3031062667cdd989ae6ec95c44d34bb8b8bbddfcf2f44ce8affc1a55eb80969dab834152b25cb05903792688ebe94fcd0393b0f5439baf3d

    • SSDEEP

      98304:SFqZ+pv3Tscod5DFasb/r5vGWD3EOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlLO:SFqZ+pLscVsb/r5vGlObAbN0IQ

    Score
    10/10
    darkcometguest16discoveryrattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks