Overview

overview

10

Static

static

3

56d407cf9e...de.exe

windows7-x64

10

56d407cf9e...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56d407cf9eec683bcda156a274f884cd965c84e0f5653967a6054c14f3c5ecde

  • Size

    574KB

  • Sample

    241226-2d6anstkgl

  • MD5

    ff1460be31b085b1a9858b5847e4a238

  • SHA1

    2fc16e43e6ea8b640a7cd2511769a07e0a5e29cd

  • SHA256

    56d407cf9eec683bcda156a274f884cd965c84e0f5653967a6054c14f3c5ecde

  • SHA512

    d42ac1c7b09a8cb64bba90e0411aee62ba720524577475a64f3a994bacf72313fe5e598217b5174ec1bf553002bc5d379ca85c2d6e3ce9e73bf8917dda67560f

  • SSDEEP

    12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3Hdsubk:zFhWAfn22m0eD1GPz8Hdxw

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      56d407cf9eec683bcda156a274f884cd965c84e0f5653967a6054c14f3c5ecde

    • Size

      574KB

    • MD5

      ff1460be31b085b1a9858b5847e4a238

    • SHA1

      2fc16e43e6ea8b640a7cd2511769a07e0a5e29cd

    • SHA256

      56d407cf9eec683bcda156a274f884cd965c84e0f5653967a6054c14f3c5ecde

    • SHA512

      d42ac1c7b09a8cb64bba90e0411aee62ba720524577475a64f3a994bacf72313fe5e598217b5174ec1bf553002bc5d379ca85c2d6e3ce9e73bf8917dda67560f

    • SSDEEP

      12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3Hdsubk:zFhWAfn22m0eD1GPz8Hdxw

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks