MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6567a1726d585e88daad82e04b9f7fee70d4ebe7b5b37e73e45f32c18233419. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6567a1726d585e88daad82e04b9f7fee70d4ebe7b5b37e73e45f32c18233419
SHA3-384 hash: c388c268eaa87b35359497b673f3d40e01cd9e1d0c282e4c1f1feee7c00b5856e89844dd0f91ff2eaa6dafacc5cbbb5e
SHA1 hash: e946b01f29686cbe0fba64e1f4072fffb22ea647
MD5 hash: 6c89cece4d0501c7229084aa9205c15c
humanhash: alaska-ink-vegan-potato
File name:zero.bin
Download: download sample
Signature DarkComet
Create hunting rule
File size:240'640 bytes
First seen:2020-07-24 10:29:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dd2e3254a193cf4be6d2ce044c38fcf5 (10 x DarkComet)
ssdeep 6144:sYLtU7Ixhnhz5TN6mJWd/7qMD8gmggf5:7sI3lFZWdqswtf5
Threatray 43 similar samples on MalwareBazaar
TLSH 6D34231DD25F6F95DAF47138A9C97068273CE42EA1E883A502612939F8D3D984FFDE01
Reporter JAMESWT_WT
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
462
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DarkComet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/32150/
Detection(s):
PUA.Win.Packer.Mpress-7
Create hunting rule

Win.Trojan.DarkKomet-1
Create hunting rule

PUA.Win.Packer.Exe-6
Create hunting rule

Win.Trojan.Darkkomet-6745084-0
Create hunting rule

Win.Trojan.Vobfus-6875610-0
Create hunting rule

Win.Trojan.Darkkomet-7113180-0
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Win.Trojan.DarkKomet-185
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Result
Threat name:
DarkComet
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/397246
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6567a1726d585e88daad82e04b9f7fee70d4ebe7b5b37e73e45f32c18233419/
Threat name:
Win32.Backdoor.Fynloski
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 10:30:30 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
00bafc075224d7f64e56ed9d1163c024a4049f195c8fb2ed623a754916db31b6
DarkComet
2b4ee07d82837e1170065b673dab63a8fd46c522760f2b450c0f1e2bfaedef2e
DarkComet
2fdb85c7a0a29e78f22e3b994c5835178f6b54162f4d72a224d9ac9d40c3b60f
DarkComet
52b6f57b2e7a9fc832227cc0ae02794e506358a295dadcf75387755a1b84b1ea
DarkComet
6038e37ba1da37980c6d1436a98e4793843e153511b8e54f8411b428d3e31ef1
DarkComet
a207dcc816a09d6e115c0a08015779c283906a358b66c94d531df9f6e73b1033
DarkComet
bbc8f1873aefb2518b9675fdda8446a2ba7dc159bab9bfd08b40e19b654ea8bb
DarkComet
e131a045dc4874ee4eed8e75af0faeecaf86a80e18f13b9845a8b6f57686beec
DarkComet
e7662182c984884cdf7c0c436538bc82cb1d8f91c2d6bfe0cec1ba9b3d63c259
DarkComet
ea0493a75251c59cbf9ae40a8c3ed4a0808adf8071f4c297d4fe52ead18962ef
DarkComet
+ 33 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200724-2aqhebw572/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6567a1726d585e88daad82e04b9f7fee70d4ebe7b5b37e73e45f32c18233419

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32150/

Comments