MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 16


Intelligence 16 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d
SHA3-384 hash: 487b028dc8e9684deb66ea59850d651f2c603c903f6ff2fb16943cac321e0b77f952680107f6251a6b425d0cd91657cc
SHA1 hash: 476f3abe525221661686a0b93f4e0e4049e652df
MD5 hash: 6049d329c2052677fe798039939ad26d
humanhash: cup-lake-lamp-island
File name:MSRSAAP.EXE
Download: download sample
Signature DarkComet
Create hunting rule
File size:357'376 bytes
First seen:2024-01-20 19:05:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a38ad86d74cafc45094a5085e33419e4 (109 x DarkComet, 1 x njrat)
ssdeep 6144:9cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37ZSoBLLjMdWnpQZh9h4:9cW7KEZlPzCy37ZSolMd0QZh9u
TLSH T13174F1A1BDD1EE12C26578FD8D21859442293E8A1F05C70376787B0E3A724E7EFA325D
TrID 40.8% (.EXE) UPX compressed Win32 Executable (27066/9/6)
40.1% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
3.1% (.EXE) Win16/32 Executable Delphi generic (2072/23)
3.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 3339d894cce17123 (2 x DarkComet)
Reporter smica83
Tags:DarkComet exe UKR

Intelligence

File Origin
# of uploads :
1
# of downloads :
327
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/471895/
Detection(s):
PUA.Win.Packer.UpxProtector-1
Create hunting rule

Win.Trojan.Darkkomet-6745294-0
Create hunting rule

Win.Trojan.DarkKomet-1
Create hunting rule

Win.Trojan.Darkkomet-7113180-0
Create hunting rule

Win.Dropper.Zeus-9820070-0
Create hunting rule

Win.Dropper.Darkkomet-9857869-0
Create hunting rule

Win.Trojan.Darkkomet-9857871-0
Create hunting rule

Win.Malware.Darkkomet-9857872-0
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Win.Trojan.Darkkomet-6745084-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm darkcomet darkkomet evasive explorer fingerprint hook keylogger lolbin masquerade packed packed packed rat remote shell32 upx
Link:
https://www.filescan.io/uploads/65ac199b2593e1cd0bab20c3/reports/64ef7f7f-fb00-4142-8088-381469e11640/overview
Verdict:
Malicious
Labled as:
Backdoor.DarkKomet
Link:
https://www.hybrid-analysis.com/sample/0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/23b5985d-8842-4b29-88de-99cf72ceffc0
Result
Threat name:
DarkComet
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1378046
Signature
Antivirus / Scanner detection for submitted sample
Connects to many ports of the same IP (likely port scanning)
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Disables UAC (registry)
Disables windows user account control
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected DarkComet
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d
Detection:
darkcomet
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-01-20 17:41:28 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
37 of 38 (97.37%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bs7zivbvr6lxbmiwlipi36bq2nm5ke7m5sqojlppm672h4culigq._file
Verdict:
malicious
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet botnet:guest16 rat trojan upx
Link:
https://tria.ge/reports/240120-xr23ysehgp/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Legitimate hosting services abused for malware hosting/C2
UPX packed file
Darkcomet
Malware Config
C2 Extraction:
5.tcp.eu.ngrok.io:16834
Unpacked files
SH256 hash:
0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d
MD5 hash:
6049d329c2052677fe798039939ad26d
SHA1 hash:
476f3abe525221661686a0b93f4e0e4049e652df
Detections:
win_darkcomet_g0
Create hunting rule
ProjectM_DarkComet_1
Create hunting rule
Link:
https://www.unpac.me/results/bdd35775-05af-4a1f-b336-fe688be5152f/
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0cbf9454358f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0cbf9454358f9770b1165a1e8df830d359d513ececa0e4adef67bfa3f0545a0d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:Malware_QA_update_RID2DAD
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:MALWARE_Win_DarkComet
Create hunting rule
Author:ditekSHen
Description:Detects DarkComet
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:ProjectM_DarkComet_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects ProjectM Malware
Reference:http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/
Rule name:ProjectM_DarkComet_1_RID2E9E
Create hunting rule
Author:Florian Roth
Description:Detects ProjectM Malware
Reference:http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXProtectorv10x2
Create hunting rule
Author:malware-lu
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_Darkcomet_1df27bcc
Create hunting rule
Author:Elastic Security
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/471895/

Comments