Overview

overview

10

Static

static

5

655c10aaa3...4b.exe

windows7-x64

10

655c10aaa3...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    655c10aaa3fcb1efe75739cb18238f4e938aab8d82de3fabbd4224b0966c194b.exe

  • Size

    559KB

  • Sample

    241218-exrv3aspev

  • MD5

    88952ba56b1ab3fcf99f8c92b2ce9a3d

  • SHA1

    0a464e7bf05fd2f8dad2a841b00df13ac82a04f6

  • SHA256

    655c10aaa3fcb1efe75739cb18238f4e938aab8d82de3fabbd4224b0966c194b

  • SHA512

    0a0d7bc168f519766bb1453dc364a35daa8d56b21f87f6c233b456f1db354ee376b7466404c1fba331feefd15f40010ef787d8ebe483634d54fa8c3cfc7ced8d

  • SSDEEP

    12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSP:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl1

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      655c10aaa3fcb1efe75739cb18238f4e938aab8d82de3fabbd4224b0966c194b.exe

    • Size

      559KB

    • MD5

      88952ba56b1ab3fcf99f8c92b2ce9a3d

    • SHA1

      0a464e7bf05fd2f8dad2a841b00df13ac82a04f6

    • SHA256

      655c10aaa3fcb1efe75739cb18238f4e938aab8d82de3fabbd4224b0966c194b

    • SHA512

      0a0d7bc168f519766bb1453dc364a35daa8d56b21f87f6c233b456f1db354ee376b7466404c1fba331feefd15f40010ef787d8ebe483634d54fa8c3cfc7ced8d

    • SSDEEP

      12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSP:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl1

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks