MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 208145a22fa6e10399360af479848df54672ea2eb542444e2f88c4299961971d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 208145a22fa6e10399360af479848df54672ea2eb542444e2f88c4299961971d
SHA3-384 hash: 58ecc910ee4fb237cb72eb042aec8e234cc980d5e852c851e24ef3f298a1892377991736bccd0d66816bb83f7c12b440
SHA1 hash: 9b8206b1e2573f34f4447d9c42af0a686e66a4c0
MD5 hash: 75df054b2777ec7d02a1661637cc9397
humanhash: crazy-steak-august-east
File name:2tRkVqK2.exe
Download: download sample
Signature DarkComet
Create hunting rule
File size:238'080 bytes
First seen:2020-09-20 13:17:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a38ad86d74cafc45094a5085e33419e4 (111 x DarkComet, 1 x njrat)
ssdeep 6144:rjFy93LU92VxOtVflFud4TnxcpPTASCmqMorHwMGoS:XFy9bPQZlFjrG0ZmYbw3oS
TLSH AD3423DDDCCF0944F5AF11319E97BC0612B0A46DEBE45FEA4A10002D9EAE5E463B532E
Reporter pmelson
Tags:DarkComet exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
330
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DarkComet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63898/
Detection(s):
PUA.Win.Packer.Upx-4
Create hunting rule

Win.Trojan.DarkKomet-7593230-0
Create hunting rule

Win.Trojan.DarkKomet-1
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

Win.Trojan.Darkkomet-6745084-0
Create hunting rule

Win.Trojan.Darkkomet-7113180-0
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Setting a keyboard event handler
Sending a custom TCP request
Sending a UDP request
Result
Threat name:
DarkComet
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/470862
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Yara detected DarkComet
Yara detected Keylogger Generic
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/208145a22fa6e10399360af479848df54672ea2eb542444e2f88c4299961971d/
Threat name:
Win32.Backdoor.DarkComet
Create hunting rule
Status:
Malicious
First seen:
2020-09-20 13:19:04 UTC
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ecaulirpu3qqhgjwbl2htben6vdhf2rowvbeitrprdcctglbs4oq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/200920-jvs8yxzrxn/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/208145a22fa6e10399360af479848df54672ea2eb542444e2f88c4299961971d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkComet

Executable exe 208145a22fa6e10399360af479848df54672ea2eb542444e2f88c4299961971d

(this sample)

  
Link
https://www.virustotal.com/gui/file/208145a22fa6e10399360af479848df54672ea2eb542444e2f88c4299961971d/detection
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/63898/

Comments