General
- Target CometSploit.zip
- Size 24.4MB
- Sample260724-wr81tstygv
- SHA256 053e0ea2ecbec6faadcfd80b8facf9775a11f4aeef90ec4c37ae6be5bdcc4133
Score
9/10
Malware Config
Targets
-
- Target CometSploit.zip
- Size 24.4MB
- SHA256 053e0ea2ecbec6faadcfd80b8facf9775a11f4aeef90ec4c37ae6be5bdcc4133
Score1/10 -
- Target CometSploit.exe
- Size 52.2MB
- SHA256 5645d099e8a49e6ed3a8c61511f9ee0f0fda3c71d18de54a242b86115e38fd98
Score6/10-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target bin/Loader.exe
- Size 3.4MB
- SHA256 60e2c058f255aa271553496a292549c13ae5bdff55a9696d6b70282a813df45f
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target bin/Module.dll
- Size 2.6MB
- SHA256 591af247ab7556919df65e9e30ffaa62f79801b2ca835864b276da986b3b55db
Score1/10 -
- Target bin/decompiler.exe
- Size 2.6MB
- SHA256 3d1775cfc009c33a04f0b6d93998e3101112f80d2005a01167394e5c3020524c
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
1