MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e
SHA3-384 hash: 7b6fa32328fc04236f3895548f99e109f19ea1b2097926796924c3777981124a5fdb63e7ac716e3962dc4f0ad0cd03bb
SHA1 hash: d5c190e5acb7f4e8d9f6286e4f48fa9bfcd1325c
MD5 hash: 723baed58f250509d277de75a3178be8
humanhash: spring-undress-blue-cola
File name:cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e
Download: download sample
Signature DarkComet
Create hunting rule
File size:707'072 bytes
First seen:2021-09-22 13:21:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8033c11f8a2fdfc317e8655120579933 (8 x DarkComet)
ssdeep 12288:m9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFC9:CiBIGkbxqEcjsWiDxguehC2St
Threatray 159 similar samples on MalwareBazaar
TLSH T18BE47D31F5808837D97229B89C5B92E5942A7E202E38754B36F63F4C5E391C37D262DB
dhash icon 59c4a6969292d845 (3 x DarkComet, 1 x MarsStealer)
Reporter JAMESWT_WT
Tags:DarkComet exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
843
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e
Verdict:
Malicious activity
Analysis date:
2021-09-22 13:47:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/495622ef-5984-424e-ab7f-b4d78aade32e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkComet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/190245/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

Win.Trojan.DarkKomet-1
Create hunting rule

Win.Trojan.Darkkomet-7113180-0
Create hunting rule

Win.Dropper.Zeus-9820070-0
Create hunting rule

Win.Trojan.Darkkomet-9857871-0
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Win.Trojan.Darkkomet-6745084-0
Create hunting rule

Win.Trojan.Vobfus-6875610-0
Create hunting rule

Win.Trojan.Agent-1242065
Create hunting rule

Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f732b393-8c02-4477-8e05-0b726d4529c0
Result
Threat name:
Darkcomet
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/855781
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to capture and log keystrokes
Contains functionality to hide user accounts
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes
Contains functionalty to change the wallpaper
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Detected Darkcomet RAT
Disables the Windows registry editor (regedit)
Disables the Windows task manager (taskmgr)
Disables UAC (registry)
Disables windows user account control
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses cmd line tools excessively to alter registry or file data
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected DarkComet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 488214 Sample: SPR6cOGNny Startdate: 22/09/2021 Architecture: WINDOWS Score: 100 49 Multi AV Scanner detection for domain / URL 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 6 other signatures 2->55 7 SPR6cOGNny.exe 1 4 2->7         started        11 msdcsc.exe 1 2->11         started        13 msdcsc.exe 1 2->13         started        process3 file4 33 C:\Users\user\AppData\Roaming\...\msdcsc.exe, PE32 7->33 dropped 35 C:\Users\user\...\msdcsc.exe:Zone.Identifier, ASCII 7->35 dropped 57 Detected Darkcomet RAT 7->57 59 Creates an undocumented autostart registry key 7->59 61 Contains functionalty to change the wallpaper 7->61 63 3 other signatures 7->63 15 msdcsc.exe 6 3 7->15         started        19 cmd.exe 1 7->19         started        21 cmd.exe 1 7->21         started        signatures5 process6 dnsIp7 37 fantomazzz.ddns.net 85.75.6.64, 1604 OTENET-GRAthens-GreeceGR Greece 15->37 39 Antivirus detection for dropped file 15->39 41 Multi AV Scanner detection for dropped file 15->41 43 Detected Darkcomet RAT 15->43 47 12 other signatures 15->47 23 notepad.exe 15->23         started        45 Uses cmd line tools excessively to alter registry or file data 19->45 25 conhost.exe 19->25         started        27 attrib.exe 1 19->27         started        29 conhost.exe 21->29         started        31 attrib.exe 1 21->31         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e/
Threat name:
Win32.Trojan.RegistryDisabler
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 10:11:18 UTC
AV detection:
45 of 45 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z3som4hvzks7jwugligqave7eyjyfkryhqg6xqpxutim2gb53wpa._file
Verdict:
malicious
Similar samples:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1
DarkComet
5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a
DarkComet
7118c3db49b6e9278fb34a7696089f4f44f3b8ae4cb85083af64ea2100c5e716
DarkComet
844fdc307207e49c308561468f99e2255b4c2759370e1c3b13919db926630d41
DarkComet
b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6
DarkComet
d35485fe44100a4643b22dc9ccaf443a4e98890710ee52701147e2144cf164ab
DarkComet
eadb655f8e92bf218894b479082dc74e0fce5a44cef4d74a6c3cf51c1773e4e3
DarkComet
f696bb0ca1c8c2d9fc4a65cacafd614945e657c262926d34f18dfe4a958ced7d
DarkComet
+ 149 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet botnet:guest16 evasion persistence rat trojan
Link:
https://tria.ge/reports/210922-ql9saacgf7/
Behaviour
Modifies registry class
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Views/modifies file attributes
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Windows security modification
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Executes dropped EXE
Sets file to hidden
Darkcomet
Modifies WinLogon for persistence
Modifies firewall policy service
Modifies security service
Windows security bypass
Malware Config
C2 Extraction:
fantomazzz.ddns.net:1604
Unpacked files
SH256 hash:
cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e
MD5 hash:
723baed58f250509d277de75a3178be8
SHA1 hash:
d5c190e5acb7f4e8d9f6286e4f48fa9bfcd1325c
Detections:
win_darkcomet_auto
Create hunting rule
win_darkcomet_g0
Create hunting rule
Link:
https://www.unpac.me/results/7b39cc0f-f551-420b-a3e4-df263354ed5c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cee4e670f5caa5f4da865a0d00549f261382aa383c0debc1f7a4d0cd183ddd9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:Malware_QA_update_RID2DAD
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/190245/

Comments