MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 7


Intelligence 7 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e
SHA3-384 hash: 49bec0559047bffe6b5a925e1d6a22a3dfda336a19d2793a1aa2de523e200fbc4d49e964634ccf6d38d7af20780e1870
SHA1 hash: 34ee0819365d8e4313bea00d100ae99d39b11bc0
MD5 hash: f183f2ab7e5d0ca6934664b4f0aa7ee9
humanhash: red-solar-bulldog-blue
File name:7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e
Download: download sample
Signature DarkComet
Create hunting rule
File size:1'874'913 bytes
First seen:2020-11-07 16:37:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:s1hZEgatRTpTyP0DjUs2EcP85eDaxw96ZMAq:s1hZEgatRTpTyP6B2EiAouw9YMd
TLSH 9A95EF35A590442DC52A1037F6628BBC2BF6EC8C4B364D1777837E5BBE7B6092A1071E
Reporter seifreed
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Vasal-9406011-0
Create hunting rule

Win.Malware.Nanocore-9406023-1
Create hunting rule

Win.Dropper.Vasal-9635263-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file in the %temp% directory
Adding an access-denied ACE
Deleting a recently created file
Replacing files
DNS request
Connection attempt
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e/
Threat name:
Win32.Trojan.Concerto
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 16:39:09 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pvioo4z24rgzf3tqhf3a52xvb2elkqbwtxugiqnyffrv4dw4la7a._file
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet evasion persistence rat trojan
Link:
https://tria.ge/reports/201108-89cjvgt1v6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Darkcomet
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e
MD5 hash:
f183f2ab7e5d0ca6934664b4f0aa7ee9
SHA1 hash:
34ee0819365d8e4313bea00d100ae99d39b11bc0
Link:
https://www.unpac.me/results/f90e16b4-9615-4da6-bb50-700f118f849a/
SH256 hash:
310410895c8ae184e50346c80af043b7f733d6b34ae47c6fd6bf663831c8bb37
MD5 hash:
dcf9b0fbd50b822ed1df18d1fa2f5b79
SHA1 hash:
4832cfbea8a5e77050351361ecd23213540aabee
Detections:
win_darkcomet_g0
Create hunting rule
win_darkcomet_auto
Create hunting rule
Link:
https://www.unpac.me/results/f90e16b4-9615-4da6-bb50-700f118f849a/
Parent samples :
c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8
7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e
eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666
544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2
fca179fad8f5926381442196918d56565af187fb4f53cc99c0dd2070831a8f1e
273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd
52d5e596c1da82e5895bcd485a98989ff1b81ab3ee5baa13a41ff1c2808493eb
SH256 hash:
dfeb0063833fb300504357213febf50ea38e818c2d0585f735977a20532c0db2
MD5 hash:
41f6553d6aefcddc273b08708b9208f3
SHA1 hash:
59576296cef3c9bdc70bc55704ad469a31c60f58
Link:
https://www.unpac.me/results/f90e16b4-9615-4da6-bb50-700f118f849a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Embedded_PE
Create hunting rule
Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments