Overview

overview

10

Static

static

5

786fcbda49...1N.exe

windows7-x64

10

786fcbda49...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    786fcbda497fb8e677121ea5a8725977cc06b994cd64c4c34833c3615b089c11N.exe

  • Size

    576KB

  • Sample

    250102-m7ebqaypgt

  • MD5

    d54540b9873f46dc838d6fb2009f4e70

  • SHA1

    589fe46475cf8120903b68d0d6d974aa90256cec

  • SHA256

    786fcbda497fb8e677121ea5a8725977cc06b994cd64c4c34833c3615b089c11

  • SHA512

    4ef259f1c26e253f55d649769b0b533529235ace5a81c6b334b37a9bd73f6f34518f17138837a98971611ace33ce21da4b49f4fdf6caf4df6a2467fa6a7a8108

  • SSDEEP

    12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSp:+NWPkHlUfBgpuPdWzyuDTifgyWlQ

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      786fcbda497fb8e677121ea5a8725977cc06b994cd64c4c34833c3615b089c11N.exe

    • Size

      576KB

    • MD5

      d54540b9873f46dc838d6fb2009f4e70

    • SHA1

      589fe46475cf8120903b68d0d6d974aa90256cec

    • SHA256

      786fcbda497fb8e677121ea5a8725977cc06b994cd64c4c34833c3615b089c11

    • SHA512

      4ef259f1c26e253f55d649769b0b533529235ace5a81c6b334b37a9bd73f6f34518f17138837a98971611ace33ce21da4b49f4fdf6caf4df6a2467fa6a7a8108

    • SSDEEP

      12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSp:+NWPkHlUfBgpuPdWzyuDTifgyWlQ

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks