MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3c44389aac31e62cd3267525d4cfebbd65c32fbaec918500b606d67b0ea62d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3c44389aac31e62cd3267525d4cfebbd65c32fbaec918500b606d67b0ea62d8
SHA3-384 hash: c439765380c82c7fc9d5960fc7203e8103ba65eb4fbd759e90696a6ba4141c7202a4ba598bde5ff0d50f9aa0e2d255f3
SHA1 hash: 31cc11a1a5ab1a5e3fe7076c62f3a23f82df4f0e
MD5 hash: 5e5a34c0f9a4a3b4a4effff0e487cada
humanhash: red-north-juliet-maine
File name:a3c44389aac31e62cd3267525d4cfebbd65c32fbaec918500b606d67b0ea62d8
Download: download sample
Signature DarkComet
Create hunting rule
File size:4'415'489 bytes
First seen:2020-06-10 11:51:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3c98c11017e670673be70ad841ea9c37 (5 x HawkEye, 5 x NanoCore, 4 x Plugx)
ssdeep 98304:IY5kFm5w7U0LkjIb7bJN15psu1hrniRN13nk+Tremqy1GWfZ:IgL5eU0IjIb7F/s0niRNAy5R
Threatray 170 similar samples on MalwareBazaar
TLSH 8F163336B38088F3C7A169795EBB22C9D1FBBB3B16B4B044D705022F7542983D7157AA
Reporter JAMESWT_WT
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
463
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAV.AOMC.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.Fynloski
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 07:40:13 UTC
File Type:
PE (Exe)
Extracted files:
36
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=upcehcnkympgftjsm5jf2th6xplfymx3v3erqualmbwwpmhkmlma._file
Verdict:
malicious
Similar samples:
0dea8bae5ab19f84a596f05732d91b60a1fa93cae6dfbbc1166d127c3e2834a0
DarkComet
1c9ac73de149a9df1d58572db60bfa8824470f11c109ea55b91aada0d6c8a2a6
DarkComet
7fce676b063449eecd1236727598513639a7fd166d6e2f86dce138b97636d572
DarkComet
8d5d64d7fe461ea3d2c4ef989b5919dd74f0d7a5803fcaeb23bda4d815f22d83
DarkComet
90bb157f9c5241f567eb56be38e3ba9f51a0ec5a8da3c77fdb1bed1f2095c39b
DarkComet
ae9576df43dd4f5e8d48c6774e7bbbd1a6baaad219c4022dd49af9fdaec57d61
DarkComet
b06c86dae636716a828d1dcc1e56ff8d6152fedba019b8da0ba0faa45aaebbd6
DarkComet
c0722d0e58ef57301d0883dcddf27c8eed901c9a01b186e6b400c48f7ff6a832
DarkComet
c67fe1304d6455bcae5c07b3f7fece584628b05d286b68da6e85275f7695b2aa
DarkComet
cbc2cd6401ee2dffa529cfac703476c24833eda31b951c8ab178b878f0247b38
DarkComet
+ 160 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet rat trojan
Link:
https://tria.ge/reports/201109-2p4mzgjq9j/
Behaviour
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Enumerates processes with tasklist
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
NSIS installer
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Loads dropped DLL
Drops startup file
Executes dropped EXE
Darkcomet
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments