MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279
SHA3-384 hash: 1a663b6ec1bca70d19fa99108a8d6e3655699361c06ba73f4c59951f79668b4662639b6d2393c1359d0e86c9e6754f6c
SHA1 hash: 482ea2b067d059eef45ee47fdb782a0e24fdab8e
MD5 hash: 614176a1e8e22a51c1106403ce3d1423
humanhash: happy-princess-july-football
File name:2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279
Download: download sample
Signature DarkComet
Create hunting rule
File size:764'827 bytes
First seen:2020-06-10 12:27:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 12288:oQnk3GDYKGcblMT+tr08R5cMjxUBwlo23w/UFm9OMaIZq3JFnZH1UOvc1o6wyF+:8AOcZR0stjxewyLPOMaIZknxaOU2yF+
Threatray 253 similar samples on MalwareBazaar
TLSH 54F40202BAD5C4B2D53209325A19AB552A3D7D202F158A7FE3EC2D3DDA350D17229FB3
Reporter JAMESWT_WT
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
452
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.DarkComet
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 00:47:06 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fp6mdd7tcv6vxaanpwht2lfhpijr6iukpy34mrrss5yhh35j2j4q._file
Verdict:
malicious
Similar samples:
10189128ff7ff4ae10111c65ca809615595304636a0d0e451ee34bf23ee900a2
DarkComet
1ca9978db84d8cad7f6a8f838e106799352c386cfa3aee2bbefa195e7fabe166
DarkComet
28d1ce2d141fcfc52b6b8a81f5424920ba2818a14e8ac201446697ff977082de
DarkComet
3a61804bb8302d42eb46c25a884cf50e7e6e383a9a48bfbfb1cfbe78ed2ed389
DarkComet
4d13350ebf3d38475a0a4a8c223fe6c06e00af3585eb499f60e29639b3944d3f
DarkComet
6d833bd671f179c8dfdf89aac0bc77cd7bb49f82a98cbf5d8122a9d47fa98e9f
DarkComet
9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
DarkComet
9d1f32d9806bafd63451a59e1768502f31cf9dc746c9e92f62b978c1ed259497
DarkComet
a1c243083cc1870948216df122047ee1a8e473d0fab33283009c0d291567ea10
DarkComet
b14306aa1789a4d6b9bfa4f8c9392033ef0fc70e584addad632135f7f832dec1
DarkComet
+ 243 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet evasion persistence rat trojan upx
Link:
https://tria.ge/reports/201109-b8nzmckars/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Modifies registry class
Adds Run key to start application
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Sets file to hidden
UPX packed file
Darkcomet
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments