Overview

overview

10

Static

static

3

06b7d3c0ad...bN.exe

windows7-x64

10

06b7d3c0ad...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06b7d3c0ad879ecd8df6bc5745807117e65ff7667c682f4d3adad20acb026dabN.exe

  • Size

    3.9MB

  • Sample

    241220-e4tm8szrfj

  • MD5

    a24375d067def5fff222a225dccf1230

  • SHA1

    261e89a9f8b7ac655934e9faaded00f648c9a03f

  • SHA256

    06b7d3c0ad879ecd8df6bc5745807117e65ff7667c682f4d3adad20acb026dab

  • SHA512

    c97bd6d5a6a137d84d12edb18ad6cecb779f69bac55781c318e731371504a8d86cd3eca2d72e1bed388fa878a46f175cddbb0ae8806fb4621e776d9ddad19969

  • SSDEEP

    98304:IlX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CX:IlX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBX

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      06b7d3c0ad879ecd8df6bc5745807117e65ff7667c682f4d3adad20acb026dabN.exe

    • Size

      3.9MB

    • MD5

      a24375d067def5fff222a225dccf1230

    • SHA1

      261e89a9f8b7ac655934e9faaded00f648c9a03f

    • SHA256

      06b7d3c0ad879ecd8df6bc5745807117e65ff7667c682f4d3adad20acb026dab

    • SHA512

      c97bd6d5a6a137d84d12edb18ad6cecb779f69bac55781c318e731371504a8d86cd3eca2d72e1bed388fa878a46f175cddbb0ae8806fb4621e776d9ddad19969

    • SSDEEP

      98304:IlX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CX:IlX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBX

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks