General

  • Target

    1024e0af873e4551473e92aac636e4d70336d80efa17cf927654491d13470fb5N.exe

  • Size

    245KB

  • Sample

    241218-f2ypvawnak

  • MD5

    d2e0491598e6219ff396c385a228f420

  • SHA1

    4213496755b6e42d365c9488e75b70412e436452

  • SHA256

    1024e0af873e4551473e92aac636e4d70336d80efa17cf927654491d13470fb5

  • SHA512

    57ac6d3cbd053e8554f430c1deef7c86b05336ac8b3491f1b440cfa3f8f05327c0dc32a3f418f6ec2be7b4112b758a76200b17ab65316daa35fc83d468f90e55

  • SSDEEP

    6144:7pkEWLxcJ2+XgbvRMdS7p6UMQgkZwgJqnHRZZ/8xuiq:qE0cDXgbsSWQgkZj0HRZB8ML

Malware Config

Targets

    • Target

      1024e0af873e4551473e92aac636e4d70336d80efa17cf927654491d13470fb5N.exe

    • Size

      245KB

    • MD5

      d2e0491598e6219ff396c385a228f420

    • SHA1

      4213496755b6e42d365c9488e75b70412e436452

    • SHA256

      1024e0af873e4551473e92aac636e4d70336d80efa17cf927654491d13470fb5

    • SHA512

      57ac6d3cbd053e8554f430c1deef7c86b05336ac8b3491f1b440cfa3f8f05327c0dc32a3f418f6ec2be7b4112b758a76200b17ab65316daa35fc83d468f90e55

    • SSDEEP

      6144:7pkEWLxcJ2+XgbvRMdS7p6UMQgkZwgJqnHRZZ/8xuiq:qE0cDXgbsSWQgkZj0HRZB8ML

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Windows security bypass

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks