MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8
SHA3-384 hash: ddf7291dc5401dd38579737e3057efb90f935ccd902eec23484ee53459480055f89888c95947402db696a90401c96644
SHA1 hash: 86470e960e1615885e2587ac72681d5f304a69bd
MD5 hash: ce57e410fccfa5cef7fc8a54596639b1
humanhash: delaware-skylark-pip-iowa
File name:c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8
Download: download sample
Signature DarkComet
Create hunting rule
File size:1'874'913 bytes
First seen:2020-11-06 11:30:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:QChZEgatRTpTyP0DjUs2EcP85eDaxw96ZMAq:QChZEgatRTpTyP6B2EiAouw9YMd
Threatray 281 similar samples on MalwareBazaar
TLSH 4095E0357590442DC52A2037F5628BBC2BF6ED884B364D1777837E5BBEBB6092A1031E
Reporter seifreed
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Vasal-9406011-0
Create hunting rule

Win.Malware.Nanocore-9406023-1
Create hunting rule

Win.Dropper.Vasal-9635263-0
Create hunting rule

SecuriteInfo.com.Gen.Variant.Johnnie.221809.751.14920.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file in the %temp% directory
Adding an access-denied ACE
Deleting a recently created file
Replacing files
DNS request
Connection attempt
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8/
Threat name:
Win32.Backdoor.Fynloski
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 11:36:22 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfvuh4xyfseh5hipj3ie6svsoecyuv4csvx7n6pkksimcvjnfhma._file
Verdict:
malicious
Similar samples:
0112bdb90e11eb117a1066b44657e7afba86f5a6155da9c12e25c346a34b36ca
DarkComet
10189128ff7ff4ae10111c65ca809615595304636a0d0e451ee34bf23ee900a2
DarkComet
37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61
DarkComet
39a0ad9117de868c1aa3f891c58e750ef8688b829582c08c4c39098b94bf4f9c
DarkComet
6eb767d15a657e7d39c9534bbd4b24bcc9fb7d72b100b5456ac975a002ef93a9
DarkComet
7b6c1b2aaa6f7f89812ed6be3f275ff5de8827c61b14372242a617604baa0e8c
DarkComet
86c92d4b2244153a1f601168307d0c60f413631574d9c0ed3fe4c6fa890d6c26
DarkComet
8bc57dbd7aa1c3ac5b3e4f743eb616b93aec9bae6975ccdaa9ad596ada32275b
DarkComet
93716c86a95207d2a151c0b3ff70e14b16fd7bf7dace1b17449f51eb05a17c2a
DarkComet
d2d355ef39f411f81c87e1c3e6feef02a0dccacf3cc37aa583e97ab9403e2ee8
DarkComet
+ 271 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet evasion persistence rat trojan
Link:
https://tria.ge/reports/201106-2l8y5pjgkx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Darkcomet
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8
MD5 hash:
ce57e410fccfa5cef7fc8a54596639b1
SHA1 hash:
86470e960e1615885e2587ac72681d5f304a69bd
Link:
https://www.unpac.me/results/5f7e3f60-047b-40ae-a821-fac465a577bb/
SH256 hash:
310410895c8ae184e50346c80af043b7f733d6b34ae47c6fd6bf663831c8bb37
MD5 hash:
dcf9b0fbd50b822ed1df18d1fa2f5b79
SHA1 hash:
4832cfbea8a5e77050351361ecd23213540aabee
Detections:
win_darkcomet_g0
Create hunting rule
win_darkcomet_auto
Create hunting rule
Link:
https://www.unpac.me/results/5f7e3f60-047b-40ae-a821-fac465a577bb/
Parent samples :
c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8
7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e
eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666
544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2
fca179fad8f5926381442196918d56565af187fb4f53cc99c0dd2070831a8f1e
273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd
52d5e596c1da82e5895bcd485a98989ff1b81ab3ee5baa13a41ff1c2808493eb
SH256 hash:
dfeb0063833fb300504357213febf50ea38e818c2d0585f735977a20532c0db2
MD5 hash:
41f6553d6aefcddc273b08708b9208f3
SHA1 hash:
59576296cef3c9bdc70bc55704ad469a31c60f58
Link:
https://www.unpac.me/results/5f7e3f60-047b-40ae-a821-fac465a577bb/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments