Resubmissions

21-12-2024 17:42

241221-v9y3xavlaz 10

20-12-2024 23:19

241220-3bbtqawpat 10

20-12-2024 19:29

241220-x7fjwssqdm 10

General

  • Target

    XPloit.zip

  • Size

    23.9MB

  • Sample

    241220-x7fjwssqdm

  • MD5

    df5931935ffe284ca5b40791607e7a4c

  • SHA1

    262399853d05ece01f740d1e820aa892b065b1bd

  • SHA256

    3d6bc3c0247c2b4f87282da002475ac068b5b6cac948743f697832a9a4a4c6de

  • SHA512

    38ac5f801f73714c840e16c8513b3c4f2d29815f042585a61c06830a76c1cae0e7e295241be686ae2d5f4bd19503ee9e69dadd611b1389d6ea9018553df785f7

  • SSDEEP

    393216:OH+kig1whmEJ+oUAgHRsP56jvR3vJ0RPaati4b8sVNSCoOYhkhalpMJpQl+25+:sB1w/J+oUANMj53vOxavKxoqhMgpw+

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

127.0.0.1:1604

Mutex

DC_MUTEX-R2MY49E

Attributes
  • gencode

    0JGDeNqTa1iX

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Targets

    • Target

      XPloit.zip

    • Size

      23.9MB

    • MD5

      df5931935ffe284ca5b40791607e7a4c

    • SHA1

      262399853d05ece01f740d1e820aa892b065b1bd

    • SHA256

      3d6bc3c0247c2b4f87282da002475ac068b5b6cac948743f697832a9a4a4c6de

    • SHA512

      38ac5f801f73714c840e16c8513b3c4f2d29815f042585a61c06830a76c1cae0e7e295241be686ae2d5f4bd19503ee9e69dadd611b1389d6ea9018553df785f7

    • SSDEEP

      393216:OH+kig1whmEJ+oUAgHRsP56jvR3vJ0RPaati4b8sVNSCoOYhkhalpMJpQl+25+:sB1w/J+oUANMj53vOxavKxoqhMgpw+

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks