darkcomet | 1f034adbcaee560657b76fc5c0541eca51c45a30d02e35bce4ba7cfe8b7c4174

Sharing

General

Target
Darkcomet RAT 5.3.1.zip
Size 27.0MB
Sample260727-m5gn3a1alc
SHA256 1f034adbcaee560657b76fc5c0541eca51c45a30d02e35bce4ba7cfe8b7c4174
MD5 dff284aec022a3e0eb4ff5427ccf18b8
SHA1 b275520229dc796b7b0c8fc39e82bc83764c9838
SHA512 8a23940fd30348eafe9f706616ce57653b4c2810aa9bdbe7c0484b6d3eb523734a206c4c5b02537a771c7c11bffb3953f47e0b839f2887ac58a1aa348f890d62
SSDEEP 786432:pzR2qWxdMXc8r5tplTcSUtNubJd1oJIs55muvYZzgltYb51Xd:eqWDQtUtSJd2JHqdfXd
TLSH
T12B573354CCEEA606EC32057093870F4B975EC3728E622E8BAD481281D96B5F51FBB3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

109.172.8.51:4952

Mutex

6uxfo1ssIOKaDC1r

Attributes

Install_directory
%Public%
install_file
System.exe

aes.plain

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Targets

- Target
  Darkcomet RAT 5.3.1.zip
- Size 27.0MB
- SHA256 1f034adbcaee560657b76fc5c0541eca51c45a30d02e35bce4ba7cfe8b7c4174
- MD5 dff284aec022a3e0eb4ff5427ccf18b8
- SHA1 b275520229dc796b7b0c8fc39e82bc83764c9838
- SHA512 8a23940fd30348eafe9f706616ce57653b4c2810aa9bdbe7c0484b6d3eb523734a206c4c5b02537a771c7c11bffb3953f47e0b839f2887ac58a1aa348f890d62
- SSDEEP 786432:pzR2qWxdMXc8r5tplTcSUtNubJd1oJIs55muvYZzgltYb51Xd:eqWDQtUtSJd2JHqdfXd
- TLSH
  T12B573354CCEEA606EC32057093870F4B975EC3728E622E8BAD481281D96B5F51FBB3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery darkcomet xworm persistence privilege_escalation ransomware rat trojan
- Detect Xworm Payload
- Family: Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1
- Target
  Darkcomet RAT 5.3.1/Celesty Binder/Celesty.exe
- Size 2.7MB
- SHA256 0bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352
- MD5 c3009ee63bc661d9ea75eaeb256448ca
- SHA1 45eb01150756df432e25eed44d976442473356de
- SHA512 96f5847fbeef95df1309e97a4bc3d786a5f5c19b87e804f12d88b4473a0b50291c40407a3d95a2d5d78031f03be76da47f1846a73c7802ddae46a38ac4634e67
- SSDEEP 49152:vOY/SiSf6KSIshmgTlxRQv9rn0KtX2pyJz0qGoy/:tKZshhYv9ptXZJe/
- TLSH
  T154D55AD362DA183AC0A632B60C3F8B51543EEF20165659961AB43D4CFF35187EC29DAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/bin/gcc.exe
- Size 789KB
- SHA256 27d8ea1223c1cf411773a39e8ef406d1f1d5d8956a0351ba8c74cc6c87978258
- MD5 43acaac9b437bd941c793ca6d9e776f7
- SHA1 c7de884538ea84e50127331fde9642c4b99fa966
- SHA512 6587acc6c03afdfb7ac5e48f01978832dac491f9cdd86d1bc68f997e85000056cbfe6c27462ec3713c4bfad139f7a4937a0258eed98cede48dddacc2f17cac2d
- SSDEEP 12288:TS1H1JPxbIyLdAKqchyKHxWSwbq7/8c841yZR1af23HPfANwe:TS1rxb/LfvyKHxWSsq7/8c8K0kNwe
- TLSH
  T148055B91FA87E1F6EC5705704583E7EF9331F252C834CEB6E6DCAA4DFA13921042A649
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/bin/libiconv-2.dll
- Size 912KB
- SHA256 5e3e889409110f7b7c2400f522b31d77b64fb3ab76ccfb9733acde34a07b7ad3
- MD5 661d92527d19257cba74a711bd3a5666
- SHA1 5c02b30aa0facdce317b981eba7a46827942e783
- SHA512 b9a5a59a82abae523db746f48465bdadd655f6553c9dfef92a3b14fd2d561e67c90605ce01210c7476c77ed688e8ef398e25ed5f319492a79cf8284dae8398a8
- SSDEEP 24576:2n+PBAUZLYbB7bbTZpGavkg3NyeuQ6l9fHuf:ZBAUZLYbBRpGaXBuQQ9O
- TLSH
  T10B15CF86F3C2CF23F563C5B4897AAB7AD522ED229B0A803776A4778D9D737E450C4016
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/bin/windres.exe
- Size 1.1MB
- SHA256 f245956c930f220f0bedf355a751a5cd738b4ec6bb6c5d584199ab3fa6c0a1c4
- MD5 18cd4a34ca3111b58afd6b45d4c92817
- SHA1 c1e73bf677aa8cec0cf2d11e196cceed24235a31
- SHA512 088207b82c8523e9c1e12f0d47eea05020ebb03e76306be891ce7c371c2ae0507037697336fc88a25fefa8f451cb83acb1adc6f9d1488917df8291e1f9e7546e
- SSDEEP 24576:p57RBAzPkZ4ITfWJWhQJS8Q2wZua8iU29CmSBsrKbVT32s7NTTx6sO8C5ZuG:DgZxJaK5wZnq2sma2sxTTdRC5b
- TLSH
  T1CD4529D0FAE708F5E5939179819BA33F5A3493010032D7BFEB68A96EFD336912509349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral5
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/cc1.exe
- Size 12.5MB
- SHA256 6ce68e248fb64e366aaa6a5fe34fbf530299337de34f03d51dac6b59c86b9a0d
- MD5 72d8fe1f322d4eadbe4b825d0fbba8e3
- SHA1 14111de0cf33c5608e2d800e96f0bdb8132b7105
- SHA512 5f0e73be9ad6f5661b8a9a276966122c96453f73cf6f2dbbf10ac31eee8888c20217ac0b608f69e8302029352e620036804ee8733a5e5e62a104adad9245ffcb
- SSDEEP 196608:hRehstjis1CX02vdiyLHA/wT47rMR7v37nnds8hWRJsjoPP/HcSOYJfwskFueKy6:BNizBLT3rn8ozo5NZ
- TLSH
  T18FD66B5ADAC751F1FC9716B06083F7BF9B30B301C420CDFADBE89959EA17A52241A346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libcloog-isl-3.dll
- Size 118KB
- SHA256 ff6cadf145cd39b19af0b4183eb7c98bbe2e9195d03ded4117be153052ad46bc
- MD5 301bccd39510e47ba9bcb199c15319f7
- SHA1 a1c0ade259f3c504e0a3d2a06b1f23218f15f0f7
- SHA512 2d692d7581ad3dc95c6222b02628dd805748ccaf5276674d5f4633d3cfc64847a6d81b87f9c82a1f866e4a0a3b48493671db4e3caf6d400304eb547c6ead3997
- SSDEEP 3072:xE2cjDBANvFE4em/grHPTZZuoZDuURMF:xnIBQvFMTdZDuURu
- TLSH
  T1B4C3E588FD8B45F5ED6B44B494D6FBBF8D319201D824CCA2FF0C9984EF13A22652C659
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libgmp-3.dll
- Size 416KB
- SHA256 3bd2deaddc781222f78722e1b734a91da27b9f0e679238e624d83015506a2a54
- MD5 fe5c6a36e0a8829823ba55b9d6429521
- SHA1 b0fcdefd0c045c8d5b2bb7e1a95cf6a0938c8b9b
- SHA512 c1134a9e515db42ac062de0a79995a7d5cc44ad67461ba960ef3239c4ce467c10af4c3a5017c0ad75197b82f3f9df53bb975e5af01ef07430e6414d13252c39c
- SSDEEP 12288:V3lXwDJgHnQT177vg8oC1IYrK/j2BUxGtpnmKdl38J:rXw1gHQTt7o8oC1IYrK/jDxor8J
- TLSH
  T129942995E6CB14F1E44759B191D3F77F5B309B12C020C93EEA98EE85EB73A93202E215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libiconv-2.dll
- Size 912KB
- SHA256 ba2285e9081fc62a7bf6f6bb3deaef88b43df5312d2aa2c5216ca061e0b3f462
- MD5 48e2735197d6dcdb9e770de6c9f6da6c
- SHA1 2048bc4f47230541d4c41706ab63e2f2cdd0a178
- SHA512 73a15c57cbfe79e69a1361833d667cdea0e12154c7ab79a31519eb507dc145e07bbae320aef62e69f94f4570bbbbfdcd15e345d491448ab54a06b3343455044f
- SSDEEP 24576:Rn+PBAUZLYbB7bbTZpGavkg3NyeuQ6l9fHuf:aBAUZLYbBRpGaXBuQQ9O
- TLSH
  T18D15CF86F3C2CF23F563C5B4897AAB7AD522ED229B0A803776A4778D9D737E450C4016
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libisl-10.dll
- Size 910KB
- SHA256 1d210067f31ba2d8135416c61805b22fb191add0ab2165e6da4ef549a8fab5fc
- MD5 22ae27db2aa723df78bfb0082c8d655c
- SHA1 13c22b295c23e838fded260d3dd68370f9fead17
- SHA512 04486ed3ce9dab682bf8307391c98c9e191805b777ba9bd490290b9a30bb53aecf8859a918ed6da0f11e52fdeec3012618a77d9895ea59edb847c33685add32c
- SSDEEP 24576:05LiZSaBsEwxc6IhQN/HUq/jA/U99H5E4az3B3ijPBOXGTRkmECMC+:0cZlu4xuM/U99ZeRi0MRXECM
- TLSH
  T15215088DEDC759F2E8A319F19997FBEF4B31D3025434CEB4C61DAC48E92392A221D158
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libmpc-2.dll
- Size 73KB
- SHA256 615088d6ae8eb77a6cfed97616a76a992843794f67a6d0e2a496dd1298a9b5ad
- MD5 06bd9185c36cf58b25f3cb76eb8cca45
- SHA1 aacb00411e2870f4e21b986bd73bd270f25b4468
- SHA512 a3c15d0482545091ca1de236987b12af3db4f81aadd65b306a5d04fd4dcd3f3d11759f9ea247dfeaa8e8675e038ba92cb16d1b549a8c4fc474a8acec900d5af0
- SSDEEP 768:z27NsAbyiGGVuGc0ZVicV7ZPmP5lZidIkOS160/J61SlRuhxHXCZg72mFOrzxWLU:zFA7lT1KidIlKCQgLPsrYFk2trB2D
- TLSH
  T1F373A529FD8715F2E54B88B09196F37F1A345B02C928DDA6DF54EB90F9F3772240A218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Darkcomet RAT 5.3.1/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libmpfr-1.dll
- Size 323KB
- SHA256 33180906b102967534f32d640c43b9e4bf7de7c4967368a76349d45e8b490b4a
- MD5 5610d32d53b668c95c69b530c2250dd7
- SHA1 bd7e2953c438fd5e8d0a353f7f07685055ba80c9
- SHA512 2cfd8f398b14e76ca051a17fa2366470c2aefe0c0ceebc1b609682f2decd7ee28df13b2a0419eb6258e484d6d549ddb321d11506dc884a254d227d9a439fbfd5
- SSDEEP 6144:0gncQYrc6ylNZcLsND5gs/QXiALiKiliVmTUH6:0gnbQctNZrN1bAtM
- TLSH
  T14964E709EDC791F1FD078CB09297F77F5630A721C820CD6ADF88AE95EE63A92401A355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/include/winapi/mshtml.h
- Size 30KB
- SHA256 3d46cc9db05a96ce124700d9e9815a56057e75ead2f419ddb7cdc783de756e2b
- MD5 1b4977437930f654a046b12589a90c47
- SHA1 72dbc4c20c1a82f17e4cc205a30b79ec647edd51
- SHA512 2b9d400eb7d3b83c6935d333a0a662ca5b1c9244c87ea64bc0650b11d97ca916bc10fc51f99659c4e11de4ac20cffa8ad6683d0e767569f63af983a52434f087
- SSDEEP 192:5wyucJiWX4vynTap4/LM8rWlidgl08pVvucJiWX4vAPIVMRqrvAnir6Qd+nKdfKf:9rYDKdIV
- TLSH
  T1F7D2B87AC2C5AC4AB3E90452B4EDBF2B7DF183432D4ABD613823D8D7706954634C829B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/lib/bcheck.o
- Size 263KB
- SHA256 4579a70ff3531ad43f513feda8b71638ab3c89bbcc23f2fb32af6f2f69af93e1
- MD5 3f5f911e8247e4bbe9c7be4fbe36ac8e
- SHA1 97f8e07c036582290673a0e922fd0c7ef246d18a
- SHA512 d6c3dd13b42f4d45d68ed3b61b0ffe1b06909c43d4ffb70c35e24fc91e3e2293523165868c4fef9d0c2d536e8d765d5a5dd48b077676e5d17911a6d629777aca
- SSDEEP 6144:Y0Nulcp7m6nQZ+zv1I4WQkd1mogWl2VR:Y0NBpqE1I47kd1moHl2
- TLSH
  T1CC445C395B19CDBBD3980E3500F3670A2FBE54886BA8334616A41DAC9DD1724FC6772B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/lib/bt-dll.o
- Size 3KB
- SHA256 03ef0f20bae1a16096ef1d92a65060259ca6899308b81ac80039497664a627e7
- MD5 56826fd83ba2bdae1b36b7a441e305b5
- SHA1 0dd3f40d32372c40acc58dc6556e522c0cd6a7be
- SHA512 0e91d099dd4484ab5fb76a3875046af37ff16c2349a3fd1c061400d7904c982395b3ec15896081dc1401596f0d82e457e00fa614b7dfc30e7c2bed4749066683
- TLSH
  T16461ED198BC4CA2FC09BF6B5A3E67FDB227294A1438C2B16653C15F40F5731A2B6D94C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/lib/bt-exe.o
- Size 6KB
- SHA256 cf3a5ca28701b695ba3bbe9f5e960e7f79db6446c194acd715305a09add9fe58
- MD5 2e95b748fae1b8bf83d476b2bc033757
- SHA1 ff8b3fbf34854e9e828a0ebf1e9c31ea4409e1d6
- SHA512 400ed8c7dc04010dc92143b453272fd2c750818897bb311e72b061129af8850183414446a37555d35d9467d0fe68c614dc41dadcf9878a6c2267272482a9e33a
- SSDEEP 96:PeDt4wPodUe/35Wx5ne+f1uB/LNCwGrxurBhnDxex:51/5o5e+fu/LNE1urB5Dx
- TLSH
  T153D14E3ADB42DB3BC6570A3663D303A53131D33225A1BB5BA02029BAFF51FD66E46305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/lib/bt-log.o
- Size 1024B
- SHA256 49d9f4d2f239e535581d3d2b3858c47fb2ec88c34a6d441e8c98aeb8f71d1ad9
- MD5 733579aeacf810a59a8ec20a4f7d5a1e
- SHA1 714675f406098d57ca2326d7753bd86d0103953e
- SHA512 032a9196cc597c4ecd94e5a9707e2e378e69df152ca924f3897ca2da0c3639569db6157779f22d04c180225cc4f25dc032ae4aa809e97bdb6f55ba68cf1bd150
- TLSH
  T10711786AAB98CEB3EC93033A55D387B53735D94623C15F0B920C28302D932997F12A9C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/libtcc.dll
- Size 221KB
- SHA256 5673e555abaf7adc8856c04e2ecb63fee657aca2c1cf538f7bf4ddcfba8b78fd
- MD5 018d32ce36c442b94c89a112282106ba
- SHA1 d64c9b5ade44b0c766790581d31d2925f80c8fe8
- SHA512 cc77978a01379cbae0c45447bb8dcbc3bee99d6fce5eecbf0b5128ca965ecc71a1b86f6ec8eef79eeb4b79af1a2f9f436eecbac2ec5880f2c10e3a5cb2cbede7
- SSDEEP 3072:Uo/H0rj173sxwQYsZjqwVFg49F3UaEX6FJtdHUaXnuBRbsWJwPNAzvSEw6/wwRkI:F/H0v1oxw+9bnERbLJeE//wakI
- TLSH
  T11F246D06F6C294BDC867C2714E9BD332E4B2B8550230ED5E97E4DB746E25EA09B1E708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/tcc.exe
- Size 53KB
- SHA256 54f013a8811498a3bd20d8440a497698de96b659930001874f7c7f638f887d1d
- MD5 08c121c2147e21032d5212f3d430660a
- SHA1 e93e7cca5c3ba779a36fb14e5fdb3182d745279a
- SHA512 7b4eddb5e77d78640b56c4b970f96070bd7ed6d281f9a2d5895e7a1b4361cb5edb027068b087d71363ad617609109e6c42795022ec46b16a48cd2b468f711d27
- SSDEEP 768:S5lhh+VJ2AgP4Z1sFo1DSrsXitHcidyRPDG+VpHVZvnaIOyPCFW:YhCJ2jP4Z+mDS4XoHcidGzp19iGCFW
- TLSH
  T1FD33390AF25268F8C25AC2B5419B5B72EB72FC260330AB3E3B5DD3741F21D469E5E521
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Darkcomet RAT 5.3.1/Compilers/tinycc/x86_64-win32-tcc.exe
- Size 247KB
- SHA256 8daaad81845f30e6e09615555f96219ce8dbb281c1497a2ccbdad8e42c79b718
- MD5 0317013fd9ea6e7865c09a37a201b183
- SHA1 ffea3f9c19f8ea5f1c54ba9eb624a84dd0f1ae94
- SHA512 da23ad806d71537aa746f990ed36069848fbec64553ee7748b992d38144b5c8fe98a9056bccfacc31981f9d082ebdcedb677fe47a47babd67a8f649a750a2cb4
- SSDEEP 3072:XFD5/M9pRIaD0oEjMCLxeLHjQJPJ2yWPWAAsQfFcGBzn8wEfTEL3QpfbJKJuPfMl:r09ZkJP5WhrELApd3PMM7Cpl
- TLSH
  T18F446C16F29284FDC857C2748E9B9732E472B8150330E95E76DCDB742F26E909B2E718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  Darkcomet RAT 5.3.1/DarkComet.exe
- Size 11.4MB
- SHA256 1271c42528eaff30d23ce527346212f2453342e6e4ab1ce8e9b9304e24c407c8
- MD5 d74906c0558588f8ffa419b93243d1b1
- SHA1 61f2f979c18051686ad577f3405a096a9e5f8e52
- SHA512 c61b124a250b36e8d9303a6e6f3cb0d3278f13ab44ff919797b197b033bef83dbb31a8fa003a946714e4e75a539f767c949fc4b8af88f1a6397d9d0863b20012
- SSDEEP 196608:VWeYzbdz5dDfKEbXjGldK4lU6GJb7OMos3Fd03:cNpz5tCNXljab7OzGF6
- TLSH
  T122C6803318BDD400AF7DC12B80AC3F540A104EFB724BF851D5A572BCAA6BCBA9536D59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral21
- Target
  Darkcomet RAT 5.3.1/Spoof extensions/Spoofer.exe
- Size 2.0MB
- SHA256 12dbd354b4cc073ea7f80cc0d74bd96118362e9c120df7800cf0f9e863569f98
- MD5 894b256f41dc579a5b32828ed2f7e3db
- SHA1 06fa1a4dd30780e404c8f2e7a615fd54d6f2ae68
- SHA512 bede5a2c6e87ac6d432903109cca97fcbf60fdba082ba137a04c6ca6490a548f20910b6560821816b76744235fa19f5fcbe256c1ad9b87c2c1b8b20e5c5ac409
- SSDEEP 24576:cuAzSWYlsCSe+I3n6HgjigeCNOu6kpBiSSgmq8uWYkzJy90qeHqywdbMQTTRwQ+0:KU1Zp6kpkSSgmSWJyqqe3wdbBTubz
- TLSH
  T170A56C13E240543BC0663AFA18279B549A3F7F2066969D8B1EF03E4C4E35147ED3A69F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22