Extracted

• • Target

    search.htm

  • Size

    690KB

  • MD5

    3a6ad6eba968f935a0f12f7dff76cb3a

  • SHA1

    39803bc581a58d1c94657cb0ba57e905ccb5c735

  • SHA256

    d211f11c13e474b4e0868c62e95ce61ddd5e42b1ea8115d08c8f3f33308b12eb

  • SHA512

    ba822724d8f0576b74c5cc5cda660d8151d73425919793605369e65106bbeb34baccac9aa8118c6c3c7d37faac03728a91f35c0f76068ed79db2796830633444

  • SSDEEP

    6144:ZtsQdSXd3OCXO807Vyu4r5Oi7usDpaezjkLdSHx3wnmPfsZoh0tN2INCgdGcaKXu:LSXd3v04FzXRNU82xp0

  Score

  10^/10

  darkcometdefense_evasiondiscoveryevasionexecutionpersistencephishingransomwarerattrojanupx

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1