darkcomet | 4b4b02583f1a85e531f4218c64fe413b56e434efe05c4c522653b5de24b2b126

General

Target
roblox robux hilesi.exe
Size 251KB
Sample260809-xzx4zacm2v
SHA256 4b4b02583f1a85e531f4218c64fe413b56e434efe05c4c522653b5de24b2b126
MD5 f1584cbff71626ce056c62238f702a4b
SHA1 9e35136f0aa833f4195ea959550e5267159f96ac
SHA512 44ad5d53e223d54026322505f033b2afc1fec531742b2719767f686538cf36309a322f97103fc444c4583ee5d64a536aa105ed9e7cf8559a674e0a1cf3d36290
SSDEEP 6144:bcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL371w:bcW7KEZlPzCy37
TLSH
T1B94422A67BC59C43EAFDADFC064D0B14570533EB2EEE83919F24034871A2A8A175363D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

6zbKBeL7yAjfugVrSWmwMRsUT8JNnZcqt:1766

Mutex

DC_MUTEX-JWNTC6N

Attributes

gencode
QcFbHek2xq6c
install
false
offline_keylogger
true
persistence
false

rc4.plain

Targets

- Target
  roblox robux hilesi.exe
- Size 251KB
- SHA256 4b4b02583f1a85e531f4218c64fe413b56e434efe05c4c522653b5de24b2b126
- MD5 f1584cbff71626ce056c62238f702a4b
- SHA1 9e35136f0aa833f4195ea959550e5267159f96ac
- SHA512 44ad5d53e223d54026322505f033b2afc1fec531742b2719767f686538cf36309a322f97103fc444c4583ee5d64a536aa105ed9e7cf8559a674e0a1cf3d36290
- SSDEEP 6144:bcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL371w:bcW7KEZlPzCy37
- TLSH
  T1B94422A67BC59C43EAFDADFC064D0B14570533EB2EEE83919F24034871A2A8A175363D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

guest16 defense_evasion discovery execution darkcomet rat trojan upx
- Family: Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Windows security bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  out.upx
- Size 658KB
- SHA256 853a9fb68e651e5ec5c8f87af2dea7d84c1cbcca54b868d37b62d9ac13eb53b5
- MD5 95472aa91785f1100437e21e3138c8cb
- SHA1 d0e12305d99cd67c9a5e72b21b6fcced07898d35
- SHA512 9dc7f3601f802181070abf5c30c6317de36348c0998c4933da61505fb6cd2c2870689dc966a135cb83999bd980dd4019d3de5053ce1e637ccb4be6457442dc9f
- SSDEEP 12288:D9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:NZ1xuVVjfFoynPaVBUR8f+kN10Ed
- TLSH
  T160E46C31F6808837DD7219789C5F81E6982A7E212E39754B3AE61F0C5F3D6C239262D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4