Overview

overview

10

Static

static

3

22c39ee739...d4.exe

windows7-x64

10

22c39ee739...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22c39ee739643bb374b7b3ab27645b7a2b95581f335965365dc349d696f271d4

  • Size

    642KB

  • Sample

    250325-1nby5swqz6

  • MD5

    ca6c591a7ae42873de9f0f512107e693

  • SHA1

    e572562e39c39154b46821df84d4750034f61a81

  • SHA256

    22c39ee739643bb374b7b3ab27645b7a2b95581f335965365dc349d696f271d4

  • SHA512

    76e46e04b0489aefd11ccfa7e263c56ace00bb1b139de64f878cc8e0e75b3096be0715028ae888fe0896378238e31d6d71c8757aeba5caa625924acd191f51c0

  • SSDEEP

    12288:XwLf1o3E5LNco0u9nrFXAjqOKl0aDcoOvB2tdGH4sm+omaeZ:XQdo0g3utujqpXDcoOmdGH4sm1ma

Score
10/10
darkcometguest16discoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

darkcomet

Botnet

Guest16

C2

ariesdevil2.no-ip.org:1604

Mutex

DC_MUTEX-2ZKGCGV

Attributes
  • gencode

    gePxyhGT8qXk

  • install

    false

  • offline_keylogger

    true

  • password

    0123456789

  • persistence

    false

rc4.plain

Targets

    • Target

      22c39ee739643bb374b7b3ab27645b7a2b95581f335965365dc349d696f271d4

    • Size

      642KB

    • MD5

      ca6c591a7ae42873de9f0f512107e693

    • SHA1

      e572562e39c39154b46821df84d4750034f61a81

    • SHA256

      22c39ee739643bb374b7b3ab27645b7a2b95581f335965365dc349d696f271d4

    • SHA512

      76e46e04b0489aefd11ccfa7e263c56ace00bb1b139de64f878cc8e0e75b3096be0715028ae888fe0896378238e31d6d71c8757aeba5caa625924acd191f51c0

    • SSDEEP

      12288:XwLf1o3E5LNco0u9nrFXAjqOKl0aDcoOvB2tdGH4sm+omaeZ:XQdo0g3utujqpXDcoOmdGH4sm1ma

    Score
    10/10
    darkcometguest16discoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks