darkcomet | a8e5ad9e2057802d95e95ecd0ebb7fc29fc0c68401d6f23bee94f5b66cc4cfc3 | Triage

Sharing

General

Target

a8e5ad9e2057802d95e95ecd0ebb7fc29fc0c68401d6f23bee94f5b66cc4cfc3N.exe
Size

766KB
Sample

250208-e3wq7swqgm
MD5

924f58f7b30a6b0640b6d53b1be31ec0
SHA1

6f4d4e39d90a285c735f6f63b29d1c66279e5a4e
SHA256

a8e5ad9e2057802d95e95ecd0ebb7fc29fc0c68401d6f23bee94f5b66cc4cfc3
SHA512

f984fe95da407c8f298612019023efb51a48ebdab7a9f9e30a988b15b5395097b29417c0d8f8ab1658ed994fd665aa2c4b5a7c52a7310ddcfcb0df708cb9bf01
SSDEEP

12288:ofbh3edoSdPDze9LBApPsKNoeP313umLcUmyqC+R/qqMd0QZh9u:SR8oYzS12PVaA3LLRHqC+BqD0QZh9u

Score

10^/10

darkcomet guest16 discovery

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-7PNZC0B

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
NZCWVtLgCU/0
install
true
offline_keylogger
true
persistence
true
reg_key
winupdater

rc4.plain

Targets

- Target
  
  a8e5ad9e2057802d95e95ecd0ebb7fc29fc0c68401d6f23bee94f5b66cc4cfc3N.exe
- Size
  
  766KB
- MD5
  
  924f58f7b30a6b0640b6d53b1be31ec0
- SHA1
  
  6f4d4e39d90a285c735f6f63b29d1c66279e5a4e
- SHA256
  
  a8e5ad9e2057802d95e95ecd0ebb7fc29fc0c68401d6f23bee94f5b66cc4cfc3
- SHA512
  
  f984fe95da407c8f298612019023efb51a48ebdab7a9f9e30a988b15b5395097b29417c0d8f8ab1658ed994fd665aa2c4b5a7c52a7310ddcfcb0df708cb9bf01
- SSDEEP
  
  12288:ofbh3edoSdPDze9LBApPsKNoeP313umLcUmyqC+R/qqMd0QZh9u:SR8oYzS12PVaA3LLRHqC+BqD0QZh9u
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

guest16darkcomet

behavioral1

behavioral2