Overview

overview

10

Static

static

10

267a802558...8N.exe

windows7-x64

10

267a802558...8N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    267a8025581b5df1e5ec7c63b6d09794698cde8bbcc430786b68301713a36c78N.exe

  • Size

    658KB

  • Sample

    250116-q1ssbatngn

  • MD5

    0c1900161557183e9e34109a1e8f1e50

  • SHA1

    1525a1274d4d2953ea1577ef3dc26f0e208c4748

  • SHA256

    267a8025581b5df1e5ec7c63b6d09794698cde8bbcc430786b68301713a36c78

  • SHA512

    df853cc0ea70b43c3c641302bb92855f57a159ba067a95f11ff88e5e33e72d19149b9a881e0e6f2d42722287dd0132cf0d84a37d08805e4e304581a9e0206b95

  • SSDEEP

    12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hX:KZ1xuVVjfFoynPaVBUR8f+kN10EBN

Score
10/10
darkcometguest16discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

aytugay123.duckdns.org:63

Mutex

DC_MUTEX-HAPDWK7

Attributes
  • InstallPath

    Windows Updater

  • gencode

    Ztwp6aCBwPiM

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    CS:GO

Targets

    • Target

      267a8025581b5df1e5ec7c63b6d09794698cde8bbcc430786b68301713a36c78N.exe

    • Size

      658KB

    • MD5

      0c1900161557183e9e34109a1e8f1e50

    • SHA1

      1525a1274d4d2953ea1577ef3dc26f0e208c4748

    • SHA256

      267a8025581b5df1e5ec7c63b6d09794698cde8bbcc430786b68301713a36c78

    • SHA512

      df853cc0ea70b43c3c641302bb92855f57a159ba067a95f11ff88e5e33e72d19149b9a881e0e6f2d42722287dd0132cf0d84a37d08805e4e304581a9e0206b95

    • SSDEEP

      12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hX:KZ1xuVVjfFoynPaVBUR8f+kN10EBN

    Score
    10/10
    darkcometguest16discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks