MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkComet

Vendor detections: 15

Intelligence 15 IOCs YARA 8 File information Comments

SHA256 hash:	42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a
SHA3-384 hash:	d39280fe5661cd11eb67c6f06667c93d0ac0c2d8ade977262b0eeb75e3f4802d742dcea02beddb6ebd7b2a0ca931b2fc
SHA1 hash:	b242d76d29366b738f7b440f3eb605da0fbad953
MD5 hash:	c005eb7f7944cbcd4d9d51ae29ef65d8
humanhash:	london-golf-missouri-december
File name:	csgocheats.bin
Download:	download sample
Signature	DarkComet Create hunting rule
File size:	257'536 bytes
First seen:	2022-07-16 11:35:51 UTC
Last seen:	2022-07-17 15:50:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a38ad86d74cafc45094a5085e33419e4 (109 x DarkComet, 1 x njrat)
ssdeep	6144:ecNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37iy:ecW7KEZlPzCy37
TLSH	T1BF4422A5BFC59C43FAB9AEFC065C4B145B0533DB1EEE83629F20034831A5A96139363D
TrID	35.6% (.EXE) UPX compressed Win32 Executable (27066/9/6) 35.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.9% (.EXE) Win32 Executable (generic) (4505/5/1) 3.9% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
Reporter	KdssSupport
Tags:	DarkComet exe

KdssSupport

Uploaded with API

Intelligence

File Origin

# of uploads :

# of downloads :

527

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

darkcomet

ID:

File name:

csgocheats.exe

Verdict:

Malicious activity

Analysis date:

2022-07-15 17:31:04 UTC

Tags:

trojan rat darkcomet

Link:

https://app.any.run/tasks/4ac03cb8-1bd0-4c8e-918d-8366b7eb62f0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DarkComet

Link:

https://www.capesandbox.com/analysis/291190/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Launching a process

DNS request

Sending a custom TCP request

Unauthorized injection to a recently created process by context flags manipulation

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/26342/overview

Behaviour

MalwareBazaar

CheckScreenResolution

CheckCmdLine

Gathering data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DarkComet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7f481d73-d9ff-483e-93bf-d7ecc586f0a8

Result

Threat name:

DarkComet

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1033693

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to log keystrokes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected DarkComet

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a/

Threat name:

Win32.Backdoor.DarkComet

Status:

Malicious

First seen:

2022-07-15 22:58:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 26 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ilfnxghryeijpvbclmrwfzsad7qpqjfckl3hrtcw674mzq5kqzfa._file

Verdict:

malicious

Result

Malware family:

darkcomet

Score:

10/10

Tags:

family:darkcomet botnet:guest16 rat suricata trojan upx

Link:

https://tria.ge/reports/220716-nqlj5sbef3/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

UPX packed file

Darkcomet

suricata: ET MALWARE Backdoor.Win32.DarkComet Screenshot Upload Successful

Malware Config

C2 Extraction:

6.tcp.eu.ngrok.io:15880
6.tcp.eu.ngrok.io:1604

Unpacked files

SH256 hash:

8ea12eb31c8359da6d77d957d86e5b21e0ba4f891c20654d97910a991e0474b9

MD5 hash:

5339690b4224c476960e1c5e2bc9c817

SHA1 hash:

197a8d5506751f2d70c7876204dd669fb57fcf7c

Detections:

win_darkcomet_a0

Link:

https://www.unpac.me/results/97ee9e4c-35ec-4683-bea8-73b2b92934a1/

SH256 hash:

42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a

MD5 hash:

c005eb7f7944cbcd4d9d51ae29ef65d8

SHA1 hash:

b242d76d29366b738f7b440f3eb605da0fbad953

Detections:

win_darkcomet_g0

Link:

https://www.unpac.me/results/97ee9e4c-35ec-4683-bea8-73b2b92934a1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

DarkComet

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Intezer_Vaccine_DarkComet Create hunting rule
Author:	Intezer Labs
Description:	Automatic YARA vaccination rule created based on the file's genes
Reference:	https://analyze.intezer.com

Rule name:	Malware_QA_update Create hunting rule
Author:	Florian Roth
Description:	VT Research QA uploaded malware - file update.exe
Reference:	VT Research QA

Rule name:	Malware_QA_update_RID2DAD Create hunting rule
Author:	Florian Roth
Description:	VT Research QA uploaded malware - file update.exe
Reference:	VT Research QA

Rule name:	MALWARE_Win_DarkComet Create hunting rule
Author:	ditekSHen
Description:	Detects DarkComet

Rule name:	ProjectM_DarkComet_1 Create hunting rule
Author:	Florian Roth
Description:	Detects ProjectM Malware
Reference:	http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/

Rule name:	ProjectM_DarkComet_1_RID2E9E Create hunting rule
Author:	Florian Roth
Description:	Detects ProjectM Malware
Reference:	http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/

Rule name:	RAT_DarkComet Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
Description:	Detects DarkComet RAT
Reference:	http://malwareconfig.com/stats/DarkComet

Rule name:	win_darkcomet_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkComet

exe 42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/291190/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample