MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7662182c984884cdf7c0c436538bc82cb1d8f91c2d6bfe0cec1ba9b3d63c259. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7662182c984884cdf7c0c436538bc82cb1d8f91c2d6bfe0cec1ba9b3d63c259
SHA3-384 hash: 460f09b0a250411d892a56c707e3a9748547aa19a9c410614dd3533adddff378ab5c233752117bfc97dfbcaaf16aa788
SHA1 hash: 7c960e5b4cb45213d4a3d208ee62d96696a7f936
MD5 hash: 35c2ab412dfd7fc5bf810f1d0bd5b3d8
humanhash: papa-mobile-march-venus
File name:e7662182c984884cdf7c0c436538bc82cb1d8f91c2d6bfe0cec1ba9b3d63c259
Download: download sample
Signature DarkComet
Create hunting rule
File size:258'048 bytes
First seen:2020-06-17 09:22:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 02e1a822e1e61877a67ef2b47168ccdd (1 x DarkComet)
ssdeep 6144:IP7pVeKF74izbGwg/xZ7eRV6aXbeHStD1ZMCdG:I7pVeKFy/xJ6V1XbeyHSeG
Threatray 6 similar samples on MalwareBazaar
TLSH BF4413B9C22FF604C449D5750E4F1C48CE4D49095D098B5F39FFEC2E706EE5228BA6AA
Reporter JAMESWT_WT
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
456
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DarkComet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19353/
Detection(s):
PUA.Win.Packer.Mpress-7
Create hunting rule

PUA.Win.Packer.PrivateEXEProtector4-6192998-2
Create hunting rule

Win.Trojan.Genpack-855
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.ExplorerHijack
Create hunting rule
Status:
Malicious
First seen:
2012-11-15 06:23:00 UTC
File Type:
PE (Exe)
Extracted files:
29
AV detection:
43 of 48 (89.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=45tcdawjqseezx34brbwkof4qlfr3d4rylll7ygoyg5jwpldyjmq._file
Verdict:
suspicious
Similar samples:
1c6c9635f0c01cc93b504293351215058cf9ef8b62ca38ce71012a4875fbe0a4
DarkComet
6038e37ba1da37980c6d1436a98e4793843e153511b8e54f8411b428d3e31ef1
DarkComet
9a8c3a036cf1254bc1138c267de84ed1b6538fc2af4d675071a821df60810f87
DarkComet
9ecd33f453d14303ee13714cd9c0d6762c4d6e7ed6000fd7a6310837841ee5c1
DarkComet
a50c5d39fc21ccc51d78d76bbec723414f505f40a56961ac00b567ba0d5bda36
DarkComet
a6567a1726d585e88daad82e04b9f7fee70d4ebe7b5b37e73e45f32c18233419
DarkComet
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
persistence trojan rat family:darkcomet
Link:
https://tria.ge/reports/200624-qfvsdx4gpa/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Checks processor information in registry
Enumerates system info in registry
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Runs ping.exe
Drops file in Windows directory
Adds Run entry to start application
Deletes itself
Checks BIOS information in registry
Executes dropped EXE
Modifies WinLogon for persistence
Darkcomet
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_darkcomet_g0
Create hunting rule
Author:Kevin Breen / Jean-Philippe Teissier / botherder / Florian Roth / David Cannings / Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19353/

Comments