Extracted

Extracted

• • Target
    Darkcomet RAT 5.3.1/Celesty Binder/Celesty.exe
  • Size 2.8MB
  • SHA256 b5350c6a8fb06d9d0ac4e13e17f6a990a9cf05d0e1ce4442a534e174930ea57a
  • MD5 bea805e36d0b920d54695fc597d60bd0
  • SHA1 1022301da004c6b8e51bf04c188e74d62eb67be3
  • SHA512 2859d61fabf4caadb1aab98687372b12c4dafda62a2fa9ac43a1a14c0ade524901e45ccea1caf00392cfed77e7d095d42930f087b2469acf5e9b1ee0e7183e37
  • SSDEEP 49152:jg8EwMKqoah1DKJ8hxbxCiGS2AiJxTpWnFx+V6oZWJpvycMI:cZffrCZSCW+V3WJ5yc
  • TLSH
    T1E6D5D0EAD1FBA58CD879ECB391EBAE74A2D875BD199C06281FC51C7D53604C261A00CF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  instant-hdefense_evasiondiscoveryexecutionasyncratpersistenceratsuricata

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2
• • Target
    Darkcomet RAT 5.3.1/Darkcomet.exe
  • Size 11.3MB
  • SHA256 4dfcbbcaa5825456c8d5a123ec7c0d9902d7ce2800454371acc030584498774b
  • MD5 fcb4cf9b686fd368f2295f901b268a0e
  • SHA1 480ae29dd7d4765711837d7ed653cddc491034c4
  • SHA512 d52d44ebc5341d4911a20c80c79b72668c1929f91d5f90df67c71dc4b616eab42b81ad0cc2086ea425a0dd189a55caf85788dcf7488b7eec5be9e44959a59365
  • SSDEEP 196608:0kpw9Z0FJXSsNzHF1R8s0FZde9WA5L188JA4gIm:Xmn0zHF1RT9WSLbBB
  • TLSH
    T192C67B07C32A07D4E00DC1127EE8DD6B884C52BB536C7B6DA66EB90D8445FB92D385BE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  instant-hdefense_evasiondiscoveryexecutionasyncratdarkcometpersistenceratsuricatatrojan

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral3behavioral4
• • Target
    Darkcomet RAT 5.3.1/Spoof extensions/Spoofer.exe
  • Size 2.0MB
  • SHA256 a1ea8f03297f315944156e75193722c50b478b7e918097b85c903be2826d4d8e
  • MD5 ada92a24f89282071509a8908bcc287f
  • SHA1 bdd40bbaaafdb58d012604a5412a05645c8ef1a8
  • SHA512 2208c02943ec52bfe357ecd51df9fb5d98e157e9bfcdd1820b2eacbd9e357eed148acc45f6dbf1c31951d3c60b21c8bc1a0459190182188f8f32fcb56b54af45
  • SSDEEP 24576:qQQN3M+U8bnh0da55h2mKE+DVrYerEi/QbKFQ2+jNQoMW5FbsLErdkufQrtpqgG/:0cKWY5+m4Vc8EZbKeBDsLykGQrtH3
  • TLSH
    T180A5E00E994C0755836FD2EAF63278D381A3C762D74361837D4831D8A67313E2997AEB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  instant-hdefense_evasiondiscoveryexecutionasyncratpersistenceratsuricata

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral5behavioral6
• • Target
    Darkcomet RAT 5.3.1/sqlite3.dll
  • Size 510KB
  • SHA256 043e5570299c6099756c1809c5632eabeab95ed3c1a55c86843c0ec218940e5a
  • MD5 d3979db259f55d59b4edb327673c1905
  • SHA1 0697e8f35b5951c61a3a632d74fd96843c941628
  • SHA512 0b87c89aafd3e627c7d6bed0b833601fea1917a76a972061f32a2d9e4aa2e9e85b5e8a67cb330ca44aff17915d0fe2793798451a109d3f0b5014eed06b73bb45
  • SSDEEP 12288:eiTjR6kna/KzsHIoufPiL5JXjKaarzWovTSmja9q96fQkw8dw:em8NCzsooOPiXT6rSov2mjVw3w
  • TLSH
    T1A5B48C22E683C071F6E221B593BE5B765C2D96266325E4C37AC02DD59BB00E3767E307
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8