Overview

overview

10

Static

static

3

b87f0f6538...0N.exe

windows7-x64

10

b87f0f6538...0N.exe

windows10-2004-x64

10

Resubmissions

19-12-2024 23:24

241219-3d5vkssqhy 10

19-12-2024 23:22

241219-3cmydasqfs 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b87f0f653890bf6ee2ea43b37bb4d17fe8cbf123db499f85bc1af7cf0f8d3320N.exe

  • Size

    1.1MB

  • Sample

    241219-3cmydasqfs

  • MD5

    fc9c22daddb0faf4efba32630d8ccd60

  • SHA1

    2fd72d3d820afb309894e152a5915e9cf404fe44

  • SHA256

    b87f0f653890bf6ee2ea43b37bb4d17fe8cbf123db499f85bc1af7cf0f8d3320

  • SHA512

    3a31183414a64e1d2b64884dc7274cd5d785d2fe689e02a909c1780abd5536bb2f5b129ca4009a5d4504b84ec13c8ef3af1f76345206b638e6a0faf507fddce3

  • SSDEEP

    24576:FL1XNJ7n8+Jbpb4D6F4FqzYaQWVV2QRC7YZ7LHgY:R5Iobpb4D6F4uR1VVxRC7Y7L

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      b87f0f653890bf6ee2ea43b37bb4d17fe8cbf123db499f85bc1af7cf0f8d3320N.exe

    • Size

      1.1MB

    • MD5

      fc9c22daddb0faf4efba32630d8ccd60

    • SHA1

      2fd72d3d820afb309894e152a5915e9cf404fe44

    • SHA256

      b87f0f653890bf6ee2ea43b37bb4d17fe8cbf123db499f85bc1af7cf0f8d3320

    • SHA512

      3a31183414a64e1d2b64884dc7274cd5d785d2fe689e02a909c1780abd5536bb2f5b129ca4009a5d4504b84ec13c8ef3af1f76345206b638e6a0faf507fddce3

    • SSDEEP

      24576:FL1XNJ7n8+Jbpb4D6F4FqzYaQWVV2QRC7YZ7LHgY:R5Iobpb4D6F4uR1VVxRC7Y7L

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks