MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666
SHA3-384 hash: bec3d5abca7d333134e0da17e456e701ce9ab538c839395e773e0a34107349a5119043bd858ff4657012b6976c17c857
SHA1 hash: 05814d589db2d6c9b64e025de8183c2d705c9c38
MD5 hash: 72263cf2067ce1601a07f821b1b84755
humanhash: edward-nineteen-comet-crazy
File name:eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666
Download: download sample
Signature DarkComet
Create hunting rule
File size:1'874'913 bytes
First seen:2020-11-11 11:04:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:ohZEgatRTpTyP0DjUs2EcP85eDaxw96ZMAq:ohZEgatRTpTyP6B2EiAouw9YMd
Threatray 189 similar samples on MalwareBazaar
TLSH 6D95E035A590446DC52A1037F6628BBC2BB6EC8C0B364D1777837E4BBDBB6092E5071E
Reporter seifreed
Tags:DarkComet

Intelligence

File Origin
# of uploads :
1
# of downloads :
315
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Vasal-9406011-0
Create hunting rule

Win.Malware.Nanocore-9406023-1
Create hunting rule

Win.Dropper.Vasal-9635263-0
Create hunting rule

Win.Ransomware.Deepscan-9781665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Searching for the window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file in the %temp% directory
Adding an access-denied ACE
Deleting a recently created file
Replacing files
DNS request
Connection attempt
Blocking the User Account Control
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 11:06:22 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5m337uckpgpsk4ldamazn4iq7nwbf3ve46l3zu7bjqjlnldyszta._file
Verdict:
malicious
Similar samples:
69f0daa863cb586a1e2b00b6335bc69f7f06615b44b2f81bb5445d6912f6a80e
DarkComet
772d2f2ea97be3c0b9948701fb6743fc8f717680420fe5ce0101eac3ac6cd1c7
DarkComet
8d3c18b852f38c03b74ec7de7771a9f93e6f5e3aa44d3863567d984fed0c6d88
DarkComet
9e1de81ecb080a9d970953a62de72b6a83cc61776409098f1429c11032cbfa14
DarkComet
a72a48f073453a56e214a24edf8a203221b77bd1989b19896202a0b9f8f8b56c
DarkComet
b2f0163dc3b78efe59306d39ba94105e77373d723065663825f40e17abd5bac0
DarkComet
c21dfa284b8375b585e7d3933846c3d61337a2e0ed66cd69f1bfa81a40e4b10b
DarkComet
d6bf71b068bc124e0c9200cad32906d1aceb3e57ff99a695073f235b83ffb0fb
DarkComet
e8ac69b242f87152457399a019803c892209200c3951f6a0efc05cde5dd5edf5
DarkComet
fc1fbab23528029108a690e17c533f4c5de405b84159d95ef976bbae3fbead7e
DarkComet
+ 179 additional samples on MalwareBazaar
Result
Malware family:
darkcomet
Create hunting rule
Score:
  10/10
Tags:
family:darkcomet evasion persistence rat trojan
Link:
https://tria.ge/reports/201111-7hjjdeb5x6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Darkcomet
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666
MD5 hash:
72263cf2067ce1601a07f821b1b84755
SHA1 hash:
05814d589db2d6c9b64e025de8183c2d705c9c38
Link:
https://www.unpac.me/results/eea9409f-68b1-46e9-bb6b-01186f546ba7/
SH256 hash:
dfeb0063833fb300504357213febf50ea38e818c2d0585f735977a20532c0db2
MD5 hash:
41f6553d6aefcddc273b08708b9208f3
SHA1 hash:
59576296cef3c9bdc70bc55704ad469a31c60f58
Link:
https://www.unpac.me/results/eea9409f-68b1-46e9-bb6b-01186f546ba7/
SH256 hash:
310410895c8ae184e50346c80af043b7f733d6b34ae47c6fd6bf663831c8bb37
MD5 hash:
dcf9b0fbd50b822ed1df18d1fa2f5b79
SHA1 hash:
4832cfbea8a5e77050351361ecd23213540aabee
Detections:
win_darkcomet_g0
Create hunting rule
win_darkcomet_auto
Create hunting rule
Link:
https://www.unpac.me/results/eea9409f-68b1-46e9-bb6b-01186f546ba7/
Parent samples :
c96b43f2f82c887e9d0f4ed04f4ab271058a5782956ff6f9ea5490c1552d29d8
7d50e7733ae44d92ee7039760eeaf50e88b540369de86441b829635e0edc583e
eb37bfd04a799f257163030196f110fb6c12eea4e797bcd3e14c12b6ac789666
544529431b4a0b9511e81a8e2e253eb873806401a8e97920c13f3d3c703041b2
fca179fad8f5926381442196918d56565af187fb4f53cc99c0dd2070831a8f1e
273fc22bc707da117959cd5088c60c3052962fe183a51a2b8a6c66820723cbfd
52d5e596c1da82e5895bcd485a98989ff1b81ab3ee5baa13a41ff1c2808493eb
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Intezer_Vaccine_DarkComet
Create hunting rule
Author:Intezer Labs
Description:Automatic YARA vaccination rule created based on the file's genes
Reference:https://analyze.intezer.com
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:Malware_QA_update
Create hunting rule
Author:Florian Roth
Description:VT Research QA uploaded malware - file update.exe
Reference:VT Research QA
Rule name:RAT_DarkComet
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects DarkComet RAT
Reference:http://malwareconfig.com/stats/DarkComet
Rule name:win_darkcomet_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments