MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2
SHA3-384 hash: 6a62a580fb57824e3a000c15d2b130785cc86d0308acb061c97ce168a877569a4e267af962db1198fb0f2c57c2a84ca8
SHA1 hash: 4c19ee53594a2a2b4f714ac7e02a6801c9f37ec6
MD5 hash: e782814693445d42a8e70e04a95a4b9c
humanhash: purple-timing-missouri-four
File name:544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2
Download: download sample
Signature DarkComet
Create hunting rule
File size:1'874'913 bytes
First seen:2020-11-12 14:38:13 UTC
Last seen:2024-07-24 14:26:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:whZEgatRTpTyP0DjUs2EcP85eDaxw96ZMAq:whZEgatRTpTyP6B2EiAouw9YMd
Threatray 195 similar samples on MalwareBazaar
TLSH 5F95EF35A590446DC52A1037F6628BBC2BB6EC8C0B364D0777837E4BBD7B6092E5071E
Reporter seifreed
Tags:DarkComet

Intelligence

File Origin
# of uploads :
2
# of downloads :
762
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Vasal-9406011-0
Create hunting rule

Win.Malware.Nanocore-9406023-1
Create hunting rule

Win.Dropper.Vasal-9635263-0
Create hunting rule

Win.Packed.Emotet-9790742-0
Create hunting rule

Win.Packed.Emotet-9790818-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file in the %temp% directory
Adding an access-denied ACE
Deleting a recently created file
Replacing files
DNS request
Connection attempt
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
DarkComet
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/533424
Signature
Allocates memory in foreign processes
Creates an undocumented autostart registry key
Drops PE files with a suspicious file extension
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected AntiVM autoit script
Yara detected DarkComet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 315816 Sample: kAUs7lSQgh Startdate: 13/11/2020 Architecture: WINDOWS Score: 100 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Multi AV Scanner detection for submitted file 2->80 82 2 other signatures 2->82 14 kAUs7lSQgh.exe 21 2->14         started        18 kngmpwequb.pif 1 2->18         started        20 msdcsc.exe 2->20         started        22 msdcsc.exe 2->22         started        process3 file4 72 C:\33725277\kngmpwequb.pif, PE32 14->72 dropped 94 Drops PE files with a suspicious file extension 14->94 24 kngmpwequb.pif 4 4 14->24         started        27 wscript.exe 18->27         started        29 conhost.exe 20->29         started        31 conhost.exe 22->31         started        signatures5 process6 signatures7 90 Multi AV Scanner detection for dropped file 24->90 33 wscript.exe 1 24->33         started        35 kngmpwequb.pif 27->35         started        process8 process9 37 kngmpwequb.pif 2 33->37         started        41 wscript.exe 35->41         started        file10 68 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 37->68 dropped 84 Writes to foreign memory regions 37->84 86 Allocates memory in foreign processes 37->86 88 Injects a PE file into a foreign processes 37->88 43 wscript.exe 1 37->43         started        45 RegSvcs.exe 1 3 37->45         started        49 kngmpwequb.pif 41->49         started        signatures11 process12 file13 51 kngmpwequb.pif 43->51         started        70 C:\ProgramData\Microsoft\...\msdcsc.exe, PE32 45->70 dropped 92 Creates an undocumented autostart registry key 45->92 53 msdcsc.exe 2 45->53         started        55 wscript.exe 49->55         started        signatures14 process15 process16 57 wscript.exe 51->57         started        59 conhost.exe 53->59         started        process17 61 kngmpwequb.pif 57->61         started        process18 63 wscript.exe 61->63         started        process19 65 kngmpwequb.pif 63->65         started        signatures20 74 Injects a PE file into a foreign processes 65->74
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2/
Threat name:
Win32.Trojan.Concerto
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:41:32 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=krcssqy3jifzkepidkhc4jj6xbzyazabvduxsigbh46ty4bqigza._file
Verdict:
malicious
Similar samples:
69f0daa863cb586a1e2b00b6335bc69f7f06615b44b2f81bb5445d6912f6a80e
DarkComet
772d2f2ea97be3c0b9948701fb6743fc8f717680420fe5ce0101eac3ac6cd1c7
DarkComet
8d3c18b852f38c03b74ec7de7771a9f93e6f5e3aa44d3863567d984fed0c6d88
DarkComet
9e1de81ecb080a9d970953a62de72b6a83cc61776409098f1429c11032cbfa14
DarkComet
a72a48f073453a56e214a24edf8a203221b77bd1989b19896202a0b9f8f8b56c
DarkComet
b2f0163dc3b78efe59306d39ba94105e77373d723065663825f40e17abd5bac0
DarkComet
c21dfa284b8375b585e7d3933846c3d61337a2e0ed66cd69f1bfa81a40e4b10b
DarkComet
d6bf71b068bc124e0c9200cad32906d1aceb3e57ff99a695073f235b83ffb0fb
DarkComet
e8ac69b242f87152457399a019803c892209200c3951f6a0efc05cde5dd5edf5
DarkComet
fc1fbab23528029108a690e17c533f4c5de405b84159d95ef976bbae3fbead7e
DarkComet
+ 185 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet evasion persistence rat trojan
Link:
https://tria.ge/reports/201112-h7mb95727x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Darkcomet
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2
MD5 hash:
e782814693445d42a8e70e04a95a4b9c
SHA1 hash:
4c19ee53594a2a2b4f714ac7e02a6801c9f37ec6
Link:
https://www.unpac.me/results/b0e8d9df-7345-4ac2-bd6a-610d69602edc/
SH256 hash:
dfeb0063833fb300504357213febf50ea38e818c2d0585f735977a20532c0db2
MD5 hash:
41f6553d6aefcddc273b08708b9208f3
SHA1 hash:
59576296cef3c9bdc70bc55704ad469a31c60f58
Link:
https://www.unpac.me/results/b0e8d9df-7345-4ac2-bd6a-610d69602edc/
SH256 hash:
310410895c8ae184e50346c80af043b7f733d6b34ae47c6fd6bf663831c8bb37
MD5 hash:
dcf9b0fbd50b822ed1df18d1fa2f5b79
SHA1 hash:
4832cfbea8a5e77050351361ecd23213540aabee
Detections:
win_darkcomet_g0
Create hunting rule
win_darkcomet_auto
Create hunting rule
Link:
https://www.unpac.me/results/b0e8d9df-7345-4ac2-bd6a-610d69602edc/
Parent samples :
c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8
7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e
eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666
544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2
fca179fad8f5926381442196918d56565af187fb4f53cc99c0dd2070831a8f1e
273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd
52d5e596c1da82e5895bcd485a98989ff1b81ab3ee5baa13a41ff1c2808493eb
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments