MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
SHA3-384 hash: 6ab22b2dc942eae17e6b1831ed58d14826285ae041607f9975f4e0ae4ff76bde51a0a5cbb91b68a140e97348bc942c84
SHA1 hash: 4cc227c83d1403a29c2f68ef0afe12725e0dc996
MD5 hash: ad987dd8602b2b78090a08f73212a7a0
humanhash: september-delaware-east-solar
File name:opengl installer.exe
Download: download sample
Signature DarkComet
Create hunting rule
File size:258'048 bytes
First seen:2021-06-29 07:26:51 UTC
Last seen:2021-06-29 07:28:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a38ad86d74cafc45094a5085e33419e4 (109 x DarkComet, 1 x njrat)
ssdeep 6144:xcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:xcWkbgTYWnYnt/IDYhP
Threatray 113 similar samples on MalwareBazaar
TLSH 9F442341FA661A06F2F8BC3F26C257AB959C067FFFBD0552BB90530EB056616071D309
Reporter Anonymous
Tags:DarkComet exe RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
898
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
opengl installer.exe
Verdict:
No threats detected
Analysis date:
2021-06-29 07:28:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c131372d-195d-46a9-a3f8-a4bc5267fa81

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkComet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/168715/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

Win.Trojan.DarkKomet-1
Create hunting rule

Win.Trojan.Darkkomet-6745084-0
Create hunting rule

Win.Trojan.Darkkomet-7113180-0
Create hunting rule

Win.Dropper.Zeus-9820070-0
Create hunting rule

Win.Trojan.Darkkomet-9857871-0
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ebdf5d7-2c75-4e55-b77c-00ed58bfab9d
Result
Threat name:
DarkComet
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/809215
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to log keystrokes
Contains functionality to register a low level keyboard hook
Contains functionalty to change the wallpaper
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Disables the Windows registry editor (regedit)
Disables the Windows task manager (taskmgr)
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected DarkComet
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360/
Threat name:
Win32.Backdoor.DarkComet
Create hunting rule
Status:
Malicious
First seen:
2021-06-29 07:27:08 UTC
AV detection:
42 of 46 (91.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=livlrf6i7dlxsemppyu7agdznejsosuonv6ycwkvyaul3gsxmnqa._file
Verdict:
malicious
Similar samples:
113936749f6b08da52458f7536043df7dc3da181b084db8240d441ddc3d7c02d
DarkComet
1dbf1dba96ba53a617a9454de7321d187ed39fb65e96b0d42fe97dc36ead430d
DarkComet
70384e8c5ba3d348bf34e7071759c64c52fa2e21ac9c331e719cbf9116efa57d
DarkComet
78f238d4d7a071b5bf3a4f956a1ad26bed53df57ceb2174c8d12122499cad28f
DarkComet
7f302af881787140a57111123ef02539b6453dbe7cd61df881cbec9ac443ec87
DarkComet
9b72e407bfb2cab71a87f023aff2c3692893328852044037333a597f71592415
DarkComet
a413b2f308d79534c8989b5b1f63663c261e8258caf452ae021a4a0c291f5f7b
DarkComet
be7348ac661712d9c6ff32f570af43a435fa88015c48b6a421f3f68d944e943c
DarkComet
e8f040869e00b0d4dc00ddc6be5e0aaaaca6a700e16a1825592fc9924fee17e3
DarkComet
fee0b02e4e0358d8025fa74d2780dd557c2de871e03a82b3dd7aadaf451ea1a3
DarkComet
+ 103 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet evasion persistence rat trojan upx
Link:
https://tria.ge/reports/210629-fbpfg1gwbj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Loads dropped DLL
Disables RegEdit via registry modification
Executes dropped EXE
UPX packed file
Darkcomet
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
ff69421b187848fd2cdf09cf5ecf9fc9d1b8758a79bafe1bae2240ad29993429
MD5 hash:
d1810532055afebfe4bec1ef1f0dbc75
SHA1 hash:
d7cf3bc0efa86ee10f261795f920380813a8dc85
Detections:
win_darkcomet_g0
Create hunting rule
win_darkcomet_auto
Create hunting rule
Link:
https://www.unpac.me/results/48e62861-98bb-48d5-a1c2-0379c69b4f10/
SH256 hash:
5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360
MD5 hash:
ad987dd8602b2b78090a08f73212a7a0
SHA1 hash:
4cc227c83d1403a29c2f68ef0afe12725e0dc996
Link:
https://www.unpac.me/results/48e62861-98bb-48d5-a1c2-0379c69b4f10/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a2ab897c8f8d779118f7e29f018796913274a8e6d7d815955c028bd9a576360

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/168715/

Comments