Overview

overview

10

Static

static

10

6565c9a7ff...11.exe

windows7-x64

10

6565c9a7ff...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6565c9a7ffca26bda7eabc01f5408a937da1dd1f82372749c37bcb0e92914e11.exe

  • Size

    659KB

  • Sample

    241217-kb8jksvnev

  • MD5

    e1ab7ea71dbe7721179c6aea9004ea8e

  • SHA1

    73695b2d9b2d18bafd64726f69e9bff9a9a10059

  • SHA256

    6565c9a7ffca26bda7eabc01f5408a937da1dd1f82372749c37bcb0e92914e11

  • SHA512

    84892f44399ae879f3f5ada0a1bcb913e62c609f3433c3b0d775b77da8eba3968992c23e3d606ba0c24c90203c27828b55a48e1c1ea792808cf5e8700e83faed

  • SSDEEP

    12288:nfAFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKL:fAQ6Zx9cxTmOrucTIEFSpOG8

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      6565c9a7ffca26bda7eabc01f5408a937da1dd1f82372749c37bcb0e92914e11.exe

    • Size

      659KB

    • MD5

      e1ab7ea71dbe7721179c6aea9004ea8e

    • SHA1

      73695b2d9b2d18bafd64726f69e9bff9a9a10059

    • SHA256

      6565c9a7ffca26bda7eabc01f5408a937da1dd1f82372749c37bcb0e92914e11

    • SHA512

      84892f44399ae879f3f5ada0a1bcb913e62c609f3433c3b0d775b77da8eba3968992c23e3d606ba0c24c90203c27828b55a48e1c1ea792808cf5e8700e83faed

    • SSDEEP

      12288:nfAFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKL:fAQ6Zx9cxTmOrucTIEFSpOG8

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks