MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 dd146247f7cb47a6256829a01089d8e95d67d31d52431eeb0261333615927152. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DarkComet
Vendor detections: 7
| SHA256 hash: | dd146247f7cb47a6256829a01089d8e95d67d31d52431eeb0261333615927152 |
|---|---|
| SHA3-384 hash: | 3389684623ff7e4edc2f0fa5fa68c5d4c5929ab79a71f6d304c2253fb8aa815916359d6c83e5dd80481cfac9ac4c8207 |
| SHA1 hash: | 6fbad484bbfd66afc868c6d1d700aa3eed644e70 |
| MD5 hash: | b1418392b544a51ff07f543c3f76030f |
| humanhash: | delaware-juliet-bacon-seven |
| File name: | b1418392b544a51ff07f543c3f76030f |
| Download: | download sample |
| Signature | DarkComet |
| File size: | 1'161'728 bytes |
| First seen: | 2020-11-17 14:09:27 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'476 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:bH8551kV7k4A6kHf95cTlWCZdrp4lTeag2oiNqGewiEtLIw5UFWM6nkgWUFLBeZt:UQm6W54/WENKn2FQkx6ZGFq5ofUyc5 |
| Threatray | 86 similar samples on MalwareBazaar |
| TLSH | 1435CFE5D0283292C8E5167D8757B1DCBCF8E5A37783AA36C933A970FA72474358E025 |
| Reporter |  seifreed |
| Tags: | DarkComet |
Intelligence
File Origin
# of uploads :
1
# of downloads :
813
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Threat name:
ByteCode-MSIL.Backdoor.Androm
Status:
Malicious
First seen:
2013-10-12 00:10:00 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 76 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Score:
10/10
Tags:
family:darkcomet persistence rat trojan
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Darkcomet
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
dd146247f7cb47a6256829a01089d8e95d67d31d52431eeb0261333615927152
MD5 hash:
b1418392b544a51ff07f543c3f76030f
SHA1 hash:
6fbad484bbfd66afc868c6d1d700aa3eed644e70
SH256 hash:
b60a29e756df51c1af3487a995780954d5576ce86579eb2c7a77f6334f571ef1
MD5 hash:
c57a0caeb4057c3162c0ceebeabefd9c
SHA1 hash:
8feda34504d2a727ddaecb9bfe3d3321fe847a95
SH256 hash:
2345e6a730e7239797c7ab335af9a652960461bc5414c3b7f5347daf24ffd84c
MD5 hash:
8de577bbe6a161bea0a5bfa2adab2529
SHA1 hash:
80f49044903461f28b2a30b3843db4d7cf746ec6
SH256 hash:
776303a0a9794f0abc8696c395892d84de37b050c5adb76e2f7fe64f594090e1
MD5 hash:
ed4bd2fbf1381e22da37c09a935a51ef
SHA1 hash:
82447f22fa4d3f9de55dabad79f139cad3e6a442
SH256 hash:
19d67b74d5d6513ce51870dc24b6f7abc09439a7bf338a492b371e602818e605
MD5 hash:
871ad40599ecdfe147f382250ff47f18
SHA1 hash:
a30c972a495ae4374a38c58cc904536c32f2ad60
Detections:
win_darkcomet_g0
win_darkcomet_auto
SH256 hash:
90900ce4929bc814781c4b71ffe758dc0f6899bdbe7b765f37aa1411b524465d
MD5 hash:
5ab94f2cffdb35cb9092418c96276d5d
SHA1 hash:
a78cfb03132905dcc56355fe254965eaa699fb49
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Intezer_Vaccine_DarkComet |
|---|---|
| Author: | Intezer Labs |
| Description: | Automatic YARA vaccination rule created based on the file's genes |
| Reference: | https://analyze.intezer.com |
| Rule name: | IPPort_combo_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | IP and port combo |
| Rule name: | Keylog_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Contains Keylog |
| Rule name: | Malware_QA_update |
|---|---|
| Author: | Florian Roth |
| Description: | VT Research QA uploaded malware - file update.exe |
| Reference: | VT Research QA |
| Rule name: | RAT_DarkComet |
|---|---|
| Author: | Kevin Breen <kevin@techanarchy.net> |
| Description: | Detects DarkComet RAT |
| Reference: | http://malwareconfig.com/stats/DarkComet |
| Rule name: | win_darkcomet_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.