MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf
SHA3-384 hash: 21ae4f499748d7f445bebb2bd310fc006d983e77563ae9ec40e575a98ba7d237e7f45a268e8a8430ff99e9ac4f56d9d5
SHA1 hash: 735ff286a15378f58adc88eb874602ce40fa9876
MD5 hash: 27bfb34bccb3534fb28907887ce2d416
humanhash: whiskey-crazy-maine-missouri
File name:86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf
Download: download sample
Signature DarkComet
Create hunting rule
File size:2'100'178 bytes
First seen:2020-06-29 07:09:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner)
ssdeep 49152:zaAQGRkeCiXfF3tG8eOPY317u2nEIIJcu5W3HOyJFVIO:mAbv/ehu2EfeuEXO/O
Threatray 37 similar samples on MalwareBazaar
TLSH F3A523856A5294D4FF9D1B322688F1C10589EE7D06C2F05EEAB8BD3478B2287577309F
Reporter JAMESWT_WT
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
452
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DarkComet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15475/
Detection(s):
SecuriteInfo.com.EXE.Obfus-4.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf/
Threat name:
Win32.Packed.Themida
Create hunting rule
Status:
Malicious
First seen:
2019-02-12 02:12:56 UTC
File Type:
PE (Exe)
Extracted files:
33
AV detection:
27 of 48 (56.25%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q2vwu745q3frxm5nlnk5pchhquesc563heqg6453ep3ckhj4joxq._file
Verdict:
malicious
Similar samples:
02fbb8bf86f5163a9e3dcf6c172a709c2bd68fc9586b71c7c84627cc049da3ae
DarkComet
1a64802e01d94712cb6daf8339296b78cf0a7a81251e80937d01d975b31938dc
DarkComet
2ba0f2e22ed07ca3188c898a0c9256fd30e878916ebe669ed52b25cb18d5ccde
DarkComet
2d403f971f502d2423b11dcca6424edc460b6c290cb76107d7f36a37565791e8
DarkComet
2fdb85c7a0a29e78f22e3b994c5835178f6b54162f4d72a224d9ac9d40c3b60f
DarkComet
54efc75509d102fe879aae2a49098bd2f05183502e0ee554a3f6c1a7a4367ad9
DarkComet
56af437f8b3b60b32b7cba77fa159138a777a48e98ce0215e8ec6f97ef12b223
DarkComet
9fdf001f730abe9e97454ce266d79326fb6e7c02fa6f3c16a7bbf5485ef674c4
DarkComet
a2f0a1d469d73a11c69afc9eb12000fa7f7652305d936a10d12dabce693f878b
DarkComet
ea0493a75251c59cbf9ae40a8c3ed4a0808adf8071f4c297d4fe52ead18962ef
DarkComet
+ 27 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
persistence trojan rat family:darkcomet evasion
Link:
https://tria.ge/reports/200629-qxzww1x966/
Behaviour
Modifies Internet Explorer settings
Checks whether UAC is enabled
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run entry to start application
Program crash
Identifies Wine through registry keys
Checks BIOS information in registry
Loads dropped DLL
Executes dropped EXE
UPX packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies WinLogon for persistence
Darkcomet
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_a0
Create hunting rule
Author:David Cannings
Description:Strings from the Dark Comet 5.2 stub
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_darkcomet_g0
Create hunting rule
Author:Kevin Breen / Jean-Philippe Teissier / botherder / Florian Roth / David Cannings / Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15475/

Comments