General

  • Target

    6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a

  • Size

    343KB

  • Sample

    250227-2r4zrsssfy

  • MD5

    77fd5c6a7ed616d1146a055a9aa58720

  • SHA1

    cafacc26a98e13c768eeea3bba37973db58453c3

  • SHA256

    6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a

  • SHA512

    65fa1be05fc3df2caab383fb82af5b619ee1caedab09689878f596596ebf2972ec450fc24ae9e4c27f1639cbcac26c4b7898fa8c95ae27d4fbddb5df228f112f

  • SSDEEP

    6144:XYLtU7Ixhnhz5TN6mJWd/7qMD8gmggfojeGbfUTpYDDmu/+3fbN:osI3lFZWdqswtfJG+pG/YN

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

159.146.115.189:3131

Mutex

DC_MUTEX-6VU05UR

Attributes
  • gencode

    FbWUotbhX9sQ

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

rc4.plain

Targets

    • Target

      6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a

    • Size

      343KB

    • MD5

      77fd5c6a7ed616d1146a055a9aa58720

    • SHA1

      cafacc26a98e13c768eeea3bba37973db58453c3

    • SHA256

      6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a

    • SHA512

      65fa1be05fc3df2caab383fb82af5b619ee1caedab09689878f596596ebf2972ec450fc24ae9e4c27f1639cbcac26c4b7898fa8c95ae27d4fbddb5df228f112f

    • SSDEEP

      6144:XYLtU7Ixhnhz5TN6mJWd/7qMD8gmggfojeGbfUTpYDDmu/+3fbN:osI3lFZWdqswtfJG+pG/YN

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Ramnit family

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks