Overview

overview

10

Static

static

5

97015d0307...8N.exe

windows7-x64

10

97015d0307...8N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97015d0307f3dfffd56c4898142da5778136778a9e30180ec3863edb88beccb8N.exe

  • Size

    3.8MB

  • Sample

    250103-nnghea1lhy

  • MD5

    235e73d0f0609b03dbf9745a56169d20

  • SHA1

    2f9975e2b531bdab191b479947a74bfebf9cbc57

  • SHA256

    97015d0307f3dfffd56c4898142da5778136778a9e30180ec3863edb88beccb8

  • SHA512

    01ac3caf458adb82e88bd9216994ddedab80375e024c98de2c99abeedf7661a7659a0c684e386a1384a0f1f200993130e48e8cddcdd066c5f5e59222d41300e6

  • SSDEEP

    98304:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qr:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiJ

Score
10/10
darkcometdiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      97015d0307f3dfffd56c4898142da5778136778a9e30180ec3863edb88beccb8N.exe

    • Size

      3.8MB

    • MD5

      235e73d0f0609b03dbf9745a56169d20

    • SHA1

      2f9975e2b531bdab191b479947a74bfebf9cbc57

    • SHA256

      97015d0307f3dfffd56c4898142da5778136778a9e30180ec3863edb88beccb8

    • SHA512

      01ac3caf458adb82e88bd9216994ddedab80375e024c98de2c99abeedf7661a7659a0c684e386a1384a0f1f200993130e48e8cddcdd066c5f5e59222d41300e6

    • SSDEEP

      98304:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qr:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiJ

    Score
    10/10
    darkcometdiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks