Overview

overview

10

Static

static

1

URLScan

urlscan

https://www.youtube....

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqay1jU0k2bllWdXdaUmhZVVdlU0JkaFNRdlNZd3xBQ3Jtc0tuSTJHWFJ5U1ZBSlVDYUlSNEgzYzRwR3VqMlcxVHVtMExkQ1liRDJLX3N6MVN0SDZXakxIU0t1UWdaejVLOFlHM0FtZ1haS0Z3ZW91QTV4ZG1FQUNNWW9jZDF1WlVZcHVWV1pReTdZTlZWZEMzSVkyUQ&q=http%3A%2F%2Fwww.gameclaim.codes%2Fc46a8fb

  • Sample

    250224-m53ljaynz7

Score
10/10
darkcometguest1111defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest1111

C2

193.242.166.48:1605

Mutex

DC_MUTEX-2QRLPN3

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    Rb5l52XcV9no

  • install

    true

  • offline_keylogger

    false

  • password

    313131

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Targets

    • Target

      https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqay1jU0k2bllWdXdaUmhZVVdlU0JkaFNRdlNZd3xBQ3Jtc0tuSTJHWFJ5U1ZBSlVDYUlSNEgzYzRwR3VqMlcxVHVtMExkQ1liRDJLX3N6MVN0SDZXakxIU0t1UWdaejVLOFlHM0FtZ1haS0Z3ZW91QTV4ZG1FQUNNWW9jZDF1WlVZcHVWV1pReTdZTlZWZEMzSVkyUQ&q=http%3A%2F%2Fwww.gameclaim.codes%2Fc46a8fb

    Score
    10/10
    darkcometguest1111defense_evasiondiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks