Overview

overview

10

Static

static

5

9423bc1d28...64.exe

windows7-x64

10

9423bc1d28...64.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9423bc1d281e52a2b42d4c4904c9ac774dcac46aa278c28fa8d0e0b949c70564.exe

  • Size

    1.7MB

  • Sample

    250112-gpr7za1qhl

  • MD5

    42569d9b139c0093fa393444dfbea52e

  • SHA1

    0f661a3a1b6b9c728e8949d14db45af6e4f0d103

  • SHA256

    9423bc1d281e52a2b42d4c4904c9ac774dcac46aa278c28fa8d0e0b949c70564

  • SHA512

    a88369d7bacea297de1c5a6c9a795624d5d0c0a7a883d86c38919824bf97dcbd847f53aa411ab9e8ff82ead72b918f5c5e014dd0b1db9ee8f1b63bb69d267ee3

  • SSDEEP

    49152:7JZoQrbTFZY1iaCfnJxpCJOj6ToF1QtrOr10Z/GX:7trbTA1G4OeU4tk0ZOX

Score
10/10
darkcometsnake-5discoveryevasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Snake-5

C2

kasavetia.no-ip.biz:12321

kasavetia.no-ip.biz:45654

eu3.no-ip.biz:45654

eu3.no-ip.biz:12321
Mutex

snake

Attributes
  • gencode

    Pi2UsWcM3BhH

  • install

    false

  • offline_keylogger

    true

  • password

    Myhacker123

  • persistence

    false

Targets

    • Target

      9423bc1d281e52a2b42d4c4904c9ac774dcac46aa278c28fa8d0e0b949c70564.exe

    • Size

      1.7MB

    • MD5

      42569d9b139c0093fa393444dfbea52e

    • SHA1

      0f661a3a1b6b9c728e8949d14db45af6e4f0d103

    • SHA256

      9423bc1d281e52a2b42d4c4904c9ac774dcac46aa278c28fa8d0e0b949c70564

    • SHA512

      a88369d7bacea297de1c5a6c9a795624d5d0c0a7a883d86c38919824bf97dcbd847f53aa411ab9e8ff82ead72b918f5c5e014dd0b1db9ee8f1b63bb69d267ee3

    • SSDEEP

      49152:7JZoQrbTFZY1iaCfnJxpCJOj6ToF1QtrOr10Z/GX:7trbTA1G4OeU4tk0ZOX

    Score
    10/10
    darkcometsnake-5discoveryevasionpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks