MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkComet

Vendor detections: 18

Intelligence 18 IOCs YARA 21 File information Comments

SHA256 hash:	981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7
SHA3-384 hash:	1716dd57430d71a0dfe07df545ec0d07c1084c1a8e5ea0b17eb8b5d8a0a6f94dfe2ba36c27367b8560cb370a03844e7f
SHA1 hash:	8e11a744edab961795b0c9d04c80d23223f2df69
MD5 hash:	ff87c4abb85255960a6cd2df5d69ed6d
humanhash:	nevada-island-ohio-ten
File name:	Microsoft.exe
Download:	download sample
Signature	DarkComet Create hunting rule
File size:	694'784 bytes
First seen:	2026-04-21 18:05:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	afa29b04755418c992de6c84f739a842 (2 x DarkComet)
ssdeep	12288:48UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixym:RUKoN0bUxgGa/pfBHDb+y1HgZ8
Threatray	359 similar samples on MalwareBazaar
TLSH	T124E47D21F5808477D93229B49C5B92F5582A7E202D29794B3AF63F0C5E391C37D2A3DB
TrID	28.4% (.EXE) Win32 Executable Delphi generic (14182/79/4) 20.0% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2) 13.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.0% (.EXE) Win64 Executable (generic) (6522/11/2) 9.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	59c4a6969292d845 (4 x DarkComet, 1 x MarsStealer, 1 x BabylonRAT)
Reporter	Anonymous
Tags:	DarkComet email exe spam trojan

Anonymous

Delphi-compiled trojan disguised as Microsoft.exe, delivered via email attachment
in spam campaign. Modifies Winlogon registry key for persistence.
Drops/overwrites executable content. Analyzed on Windows 10 x64 build 19044.

Intelligence

File Origin

# of uploads :

# of downloads :

303

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

Microsoft.exe

Verdict:

Malicious activity

Analysis date:

2026-04-21 17:54:17 UTC

Tags:

delphi

Link:

https://app.any.run/tasks/68aba265-a560-4c51-8b81-abd83b055704

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DarkComet

Link:

https://www.capesandbox.com/analysis/62993/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69e7bca151cce3ff702edf46

Tags:

dropper emotet virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Creating a file

DNS request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm borland_delphi darkcomet darkcomet evasive explorer fingerprint keylogger lolbin packed remote

Link:

https://www.filescan.io/uploads/69e7bcbd81aa9ec3bc1c6d70/reports/e1e4b1c4-f4a3-4acf-a625-342003fc5d69/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-04-21T15:13:00Z UTC

Last seen:

2026-04-23T00:58:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Win32.Generic HEUR:Backdoor.Win32.DarkKomet.gen Backdoor.Win32.DarkKomet.acpa Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb Trojan-Spy.Win32.Xegumumune.sbc Trojan-Dropper.Win32.Injector.sb Backdoor.Win32.Finlosky.b Backdoor.Win32.DarkKomet.gvly Backdoor.Win32.DarkKomet.b Backdoor.Win32.Androm.sb PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7/results?tab=lookup

Malware family:

DarkComet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4a1c131d-018a-41a6-845a-1a5ddb1c7e33

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7/

Verdict:

Malicious

Threat:

Family.DARKCOMET

Link:

https://tip.neiki.dev/file/981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7

Threat name:

Win32.Trojan.ExplorerHijack

Status:

Malicious

First seen:

2026-04-21 18:07:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

37 of 38 (97.37%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=taiigbuzfc5jzgvw6xaa4chdtphaore665av6whjmkjz5wv55tlq._file

Verdict:

malicious

Label(s):

darkcomet

DarkComet

3f44d142fbdc7e297b0d520cda8499d4abd2e40a2bffa745411597d9b2030d4d

DarkComet

981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7

DarkComet

9ef45e8fc3c3333a7d2e95de498b82d09b11a3df6253fa172b7db084726a5c4e

DarkComet

a1e995c3ae3dc0bb88284a79ceb53fc6c723e0f78aaf545053f25a7927c58ab8

DarkComet

cfa850db87d98eed49dec543a7977ef9221dc62bd48c7aaaaafe1327c864aa72

DarkComet

error

DarkComet

+ 349 additional samples on MalwareBazaar

Result

Malware family:

darkcomet

Score:

10/10

Tags:

family:darkcomet botnet:guest17 discovery persistence rat trojan

Link:

https://tria.ge/reports/260421-wpnxwady4t/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Family: Darkcomet

Modifies WinLogon for persistence

Malware Config

C2 Extraction:

webms.it.com:1604
www.webms.it.com:1604

Unpacked files

SH256 hash:

981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7

MD5 hash:

ff87c4abb85255960a6cd2df5d69ed6d

SHA1 hash:

8e11a744edab961795b0c9d04c80d23223f2df69

Detections:

win_darkcomet_g0

win_darkcomet_a0

triage_darkcomet_rat

Malware_QA_update

RAT_DarkComet

check_installed_software

MALWARE_Win_DarkComet

win_darkcomet_g0

win_darkcomet_a0

triage_darkcomet_rat

Malware_QA_update

RAT_DarkComet

check_installed_software

MALWARE_Win_DarkComet

Link:

https://www.unpac.me/results/e348607d-0789-49bc-8095-58fa0aeb337f/

SH256 hash:

981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7

MD5 hash:

ff87c4abb85255960a6cd2df5d69ed6d

SHA1 hash:

8e11a744edab961795b0c9d04c80d23223f2df69

Detections:

win_darkcomet_g0

win_darkcomet_a0

triage_darkcomet_rat

Malware_QA_update

RAT_DarkComet

check_installed_software

MALWARE_Win_DarkComet

win_darkcomet_g0

win_darkcomet_a0

triage_darkcomet_rat

Malware_QA_update

RAT_DarkComet

check_installed_software

MALWARE_Win_DarkComet

Link:

https://www.unpac.me/results/e348607d-0789-49bc-8095-58fa0aeb337f/

Malware family:

DarkComet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/981083069928/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

DarkComet

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/981083069928ba9c9ab6f5c00e08e39bce07449ef7415f58e962939edabdecd7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	darkcomet_v1 Create hunting rule
Author:	RandomMalware

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	Intezer_Vaccine_DarkComet Create hunting rule
Author:	Intezer Labs
Description:	Automatic YARA vaccination rule created based on the file's genes
Reference:	https://analyze.intezer.com

Rule name:	Malware_QA_update Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	VT Research QA uploaded malware - file update.exe
Reference:	VT Research QA

Rule name:	Malware_QA_update_RID2DAD Create hunting rule
Author:	Florian Roth
Description:	VT Research QA uploaded malware - file update.exe
Reference:	VT Research QA

Rule name:	MALWARE_Win_DarkComet Create hunting rule
Author:	ditekSHen
Description:	Detects DarkComet

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RAT_DarkComet Create hunting rule
Author:	Kevin Breen <kevin@techanarchy.net>
Description:	Detects DarkComet RAT
Reference:	http://malwareconfig.com/stats/DarkComet

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.