MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
SHA3-384 hash: 902243c0e29336bda6a8c1c89f939367a18db900db156e230191eef0ec7d79cd180824517b21f1a5421d985f70d0b503
SHA1 hash: bc0111105913d61308b5164833d31574d0391543
MD5 hash: 1dc80685c258916d30f9bf2365d76ff5
humanhash: friend-artist-lamp-lithium
File name:c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
Download: download sample
Signature DarkComet
Create hunting rule
File size:954'368 bytes
First seen:2020-06-17 09:07:56 UTC
Last seen:2020-06-17 09:41:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:icVDOK/QlGdCHWeZf73Q2IxCxoJoU6OcPP+It:icFOVGdqZf7ALxCaJoU6O
Threatray 59 similar samples on MalwareBazaar
TLSH 1A15336E35E6C6DAD443EF388C447FA41232F5431C0A399B97D42AED161B6E086C93B6
Reporter JAMESWT_WT
Tags:DarkComet

Intelligence

File Origin
# of uploads :
2
# of downloads :
460
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.MSIL10.AYTX.6097.22990.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Hacktool.Generic
Create hunting rule
Status:
Malicious
First seen:
2016-08-12 14:40:57 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ylec5ytqamz5m5564kjx7gnr4vsx6m46epbhww35fi4xwzzp77mq._file
Verdict:
malicious
Similar samples:
0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
DarkComet
0a5e60319a443610bd184d1d0140036332d56430e32976e79c6aeec24be7d701
DarkComet
147c11e1c610932b1c2e0413ff84b3e6db9b4e4da9a62294fae5e25aac590013
DarkComet
1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb
DarkComet
30906d9b754f0687ae3970b83f619a22cf338a478ef6a4165a8f7e378903f616
DarkComet
52055c63e2a063c0d4489918ff3bc7e63c9ff94bb56ad95003d8594d01bb81d2
DarkComet
5261874485f9fe16a78a558734e8652f93db1d544f3be331e7f6adc06f43ee98
DarkComet
8ccce2a5d01211e5db0bcc8721dbea06422c5f3133466e4945e4d301d44df3b2
DarkComet
b54934cb8e1ff68d2c4306e5a6eb0f9e649ad1680960253c0cfa0c35a6c4d313
DarkComet
e1614a878888eddb3296e856dc5f4e63a926b9e4c899cf09da12a8f477ace4cf
DarkComet
+ 49 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
persistence spyware trojan rat family:darkcomet
Link:
https://tria.ge/reports/200624-v7pg8gxvbx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Modifies registry class
Suspicious use of FindShellTrayWindow
Modifies registry key
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies system executable filetype association
Darkcomet
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19278/

Comments