MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6
SHA3-384 hash: c5312d870897d1016b53fdb8a2b529d9c137e9a481ceb9415cd7fcbffff82c901c529f18b8f645868a2e39455075e0cc
SHA1 hash: ab7382bcfdf494d0327fccce9c884592bcc1adeb
MD5 hash: d761f3aa64064a706a521ba14d0f8741
humanhash: spring-oscar-johnny-michigan
File name:DarkComet.exe
Download: download sample
Signature DarkComet
Create hunting rule
File size:11'824'128 bytes
First seen:2022-04-28 03:53:49 UTC
Last seen:2023-03-10 21:44:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2494efc890c2356634d592bc26e3292b (1 x DarkComet)
ssdeep 196608:TPvqxSrDTVokQwhM/kSEMTQINokXJw7lW740VeqQPR:LCxSrFokQw2NjUYuWU0t
Threatray 1 similar samples on MalwareBazaar
TLSH T187C6AF13B78184B7C4733B3A9C2BDED8583A7D213E258A5B3AA43F4C1F39641A925357
TrID 40.9% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
22.8% (.EXE) Inno Setup installer (109740/4/30)
8.9% (.EXE) InstallShield setup (43053/19/16)
8.6% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.6% (.EXE) UPX compressed Win32 Executable (27066/9/6)
File icon (PE):PE icon
dhash icon f0c1e0e8dcd8cc6c (2 x DarkComet)
Reporter Anonymous
Tags:DarkComet DarkComet 5.3v exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
561
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
covid19
Create hunting rule
ID:
1
File name:
Darkcomet RAT 5.3.1.zip
Verdict:
No threats detected
Analysis date:
2020-07-04 23:24:52 UTC
Tags:
covid19
Link:
https://app.any.run/tasks/e83db0e3-3607-4e36-8946-c661c63d797c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/267342/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

Win.Trojan.DarkKomet-1
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Win.Trojan.Darkkomet-7113180-0
Create hunting rule

Win.Trojan.Barys-9799359-0
Create hunting rule

Win.Packed.Darkkomet-9819952-0
Create hunting rule

Win.Dropper.Zeus-9820070-0
Create hunting rule

Win.Dropper.Darkkomet-9857869-0
Create hunting rule

Win.Trojan.Darkkomet-9857871-0
Create hunting rule

Win.Malware.Darkkomet-9857872-0
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Win.Trojan.Darkkomet-6745084-0
Create hunting rule

Win.Trojan.Darkkomet-6805571-0
Create hunting rule

Win.Trojan.Vobfus-6875610-0
Create hunting rule

Win.Packed.Black-6963772-0
Create hunting rule

Win.Trojan.Darkkomet-317
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
darkcomet darkkomet expand.exe explorer.exe greyware keylogger packed packed rat replace.exe update.exe
Link:
https://www.filescan.io/uploads/626a0fdc2b32b1c37c69bc03/reports/95aa2a80-e52c-4fed-ac2a-f2535b173379/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/85393620-8bb4-43da-9463-936871c18f57
Result
Threat name:
DarkComet
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/984472
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected DarkComet
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6/
Threat name:
Win32.Backdoor.DarkComet
Create hunting rule
Status:
Malicious
First seen:
2012-06-13 11:12:00 UTC
File Type:
PE (Exe)
Extracted files:
318
AV detection:
38 of 42 (90.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehfanmmgtdiucvfelarkvlq6ha35c2gmoyylzu7mhwggrkvjlhta._file
Verdict:
malicious
Similar samples:
55788187a18d12723bbba31b170c83008999a405625ea9f5525d6f655ad2d565
DarkComet
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet
Link:
https://tria.ge/reports/220428-ef7vysbaf3/
Unpacked files
SH256 hash:
21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6
MD5 hash:
d761f3aa64064a706a521ba14d0f8741
SHA1 hash:
ab7382bcfdf494d0327fccce9c884592bcc1adeb
Detections:
win_darkcomet_g0
Create hunting rule
Link:
https://www.unpac.me/results/326f4740-59b9-4529-8808-f1a3b05c8e59/
Parent samples :
21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6
8df919d13e79c80c26053c7aa529fc3a0b49c0db77f957b38c49e80e9ffb53a4
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/21ca06b18698/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:MALWARE_Win_DarkComet
Create hunting rule
Author:ditekSHen
Description:Detects DarkComet
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/267342/

Comments