[Xylitol]

https://www.virustotal.com/en/file/910a ... 372068131/

Code: Select all

#BEGIN DARKCOMET DATA --
MUTEX={DC_MUTEX-0GT9PZS}
SID={Victime}
FWB={0}
NETDATA={durexbanana.no-ip.org:200}
GENCODE={YMrQHmVj2WLc}
INSTALL={1}
COMBOPATH={9}
EDTPATH={java\java.exe}
KEYNAME={MicroUpdate}
EDTDATE={16/04/2007}
PERSINST={0}
MELT={0}
CHANGEDATE={0}
DIRATTRIB={2}
FILEATTRIB={2}
OFFLINEK={1}
#EOF DARKCOMET DATA --

https://www.virustotal.com/en/file/3795 ... 372068190/

Code: Select all

#BEGIN DARKCOMET DATA --
MUTEX={DC_MUTEX-6H7XN68}
SID={V10}
FWB={0}
NETDATA={adrif.sivispacemparabellum.com.ru:90}
GENCODE={peCpxfAQmPgg}
OFFLINEK={1}
#EOF DARKCOMET DATA --

[Xylitol]

https://www.virustotal.com/en/file/8dab ... 372459900/

Code: Select all

#BEGIN DARKCOMET DATA --
MUTEX={DC_MUTEX-8Y3BT84}
SID={new}
FWB={0}
NETDATA={updateceb.zapto.org:7642}
GENCODE={7yJLy6pFGD68}
INSTALL={1}
COMBOPATH={7}
EDTPATH={MSDCSC\msdcsc.exe}
KEYNAME={MicroUpdate}
EDTDATE={16/04/2007}
PERSINST={1}
MELT={0}
CHANGEDATE={0}
DIRATTRIB={6}
FILEATTRIB={6}
SH5={1}
CHIDEF={1}
CHIDED={1}
PERS={1}
OFFLINEK={1}
#EOF DARKCOMET DATA --

https://www.virustotal.com/en/file/6fb2 ... 372459969/

Code: Select all

#BEGIN DARKCOMET DATA --
MUTEX={DC_MUTEX-2NZB5TU}
SID={Guest1}
FWB={0}
NETDATA={216.212.252.18:1080|anonymousfile.no-ip.biz:1080|anonymousfile.no-ip.biz:200}
GENCODE={vTwqt4Y6rMYY}
INSTALL={1}
COMBOPATH={10}
EDTPATH={MSDCSC\msdcsc.exe}
KEYNAME={MicroUpdate}
EDTDATE={16/04/2007}
PERSINST={1}
MELT={0}
CHANGEDATE={0}
DIRATTRIB={6}
FILEATTRIB={6}
FAKEMSG={1}
MSGTITLE={}
MSGCORE={434F4D504C455445203A33}
MSGICON={0}
SH4={1}
SH6={1}
SH7={1}
SH9={1}
CHIDEF={1}
CHIDED={1}
PERS={1}
OFFLINEK={1}
#EOF DARKCOMET DATA --

[thisisu]

Infected warez I think:

https://www.virustotal.com/en/file/1bc6 ... 374880346/

Was located here on a customer's Win8 laptop. C:\Program Files\GreenTree Applications\YTD Video Downloader\YTD_Downloader_Patch_c.exe

Keylogged data stored at : %AppData%\dclogs
and those sessions are stored in registry like the below:

Code: Select all

[HKEY_CURRENT_USER\Software\DC3_FEXEC]
"7/26/2013 at 4:18:17 PM"="{847e48a5-d6ef-11e1-af98-806e6f6e6963-4003718027}"
[HKEY_CURRENT_USER\Software\DC3_FEXEC]
"7/26/2013 at 4:21:14 PM"="{847e48a5-d6ef-11e1-af98-806e6f6e6963-4003718027}"

[Wack0]

https://www.virustotal.com/file/8d70b8d ... /analysis/

Darkcomet RAT plus the *actual* IW5M launcher in .NET (probably VB.NET due to Microsoft.VisualBasic.dll reference) crypted file.

Decrypts and uses reflection to call in memory a function from a .NET library (A.dll) that does the actual work.

This library (original + ran through de4dot) + both unpacked files included in attached zip.

[forty-six]

Standard Pass

[Xylitol]

https://www.virustotal.com/en/file/f5fa ... 391738475/

Code: Select all

#BEGIN DARKCOMET DATA --
MUTEX={DC_MUTEX-96SQ42J}
SID={Bot}
FWB={0}
NETDATA={flashezdns.no-ip.org:1500}
GENCODE={Cv3rG4AEulhQ}
OFFLINEK={1}
#EOF DARKCOMET DATA --

IP: 86.68.244.21:1500/TCP - ( 21.244.68.86.rev.sfr.net )

[Xylitol]

https://translate.google.com/translate? ... retours%2F
https://www.virustotal.com/en/file/39a0 ... 437323712/

Code: Select all

#BEGIN DARKCOMET DATA --
MUTEX={DC_MUTEX-8KD207Y}
SID={Server_01}
FWB={0}
NETDATA={projector123.zapto.org:1606}
GENCODE={QLg3uRtbq5r6}
INSTALL={1}
COMBOPATH={3}
EDTPATH={WINCOMPENENTS\wincomp.exe}
KEYNAME={Windows Compenents}
EDTDATE={16/04/2007}
PERSINST={1}
MELT={1}
CHANGEDATE={1}
DIRATTRIB={6}
FILEATTRIB={6}
FAKEMSG={1}
MSGTITLE={ERREUR}
MSGCORE={4572726F7220696E206C6F6164696E672028436F6465203A20307830303039386529}
MSGICON={16}
SH1={1}
SH3={1}
SH7={1}
CHIDEF={1}
CHIDED={1}
PERS={1}
OFFLINEK={1}
#EOF DARKCOMET DATA --

Files related (Athena botnet) connect to opsannonity2.i234.me who appear to be a Synology NAS.
86.221.66.223 - APoitiers-655-1-322-223.w86-221.abo.wanadoo.fr - FAI: Orange

[Linkcabin]

Taken from an obvious YouTube spreading scheme.

IP:108.85.128.137
ISP: AT&T U-verse
Key: #KCMDDC51#-
C&C: sss.no-ip.biz:200

Most likely home connection, uses as a TS Server too.

https://www.planetteamspeak.com/serverl ... .137:9987/

Badly Formatted Config, Just straight from dump.

Code: Select all

#BEGIN DARKCOMET DATA --..MUTEX={DC_MUTEX-EDJTTGP}..SID={Guest16}..FWB={0}..NETDATA={sss.no-ip.biz:200}..GENCODE={RrHH19cKVT1G}..INSTALL={1}..COMBOPATH={10}..EDTPATH={MSDCSC\msdcsc.exe}..KEYNAME={system32.dll}..EDTDATE={16/04/2007}..PERSINST={1}..MELT={1}..CHANGEDATE={0}..DIRATTRIB={6}..FILEATTRIB={6}..FAKEMSG={1}..MSGTITLE={Thank you}..MSGCORE={796F752068617665206A75737420696E7374616C6C6564206120737465616D206B65792067656E6F7261746F7221}..MSGICON={64}..SH1={1}..SH5={1}..SH7={1}..SH8={1}..SH9={1}..SH10={1}..CHIDEF={1}..CHIDED={1}..PERS={1}..OFFLINEK={1}..#EOF DARKCOMET DATA --

[praspram]

Can somebody post a little more info on the functioning of this malware?

[Xylitol]

there are plenty of write ups
→ https://blog.malwarebytes.org/intellige ... darkcomet/
http://resources.infosecinstitute.com/d ... sis-syria/
https://asert.arbornetworks.com/wp-cont ... eport1.pdf
http://matasano.com/research/PEST-CONTROL.pdf
Use google next time.