darkcomet | 52b6f57b2e7a9fc832227cc0ae02794e506358a295dadcf75387755a1b84b1ea | Triage

Sharing

General

Target

52b6f57b2e7a9fc832227cc0ae02794e506358a295dadcf75387755a1b84b1ea
Size

449KB
Sample

200624-1n4gyrkn6s
MD5

8a488db081cc65579bf9f2f0e7e402d4
SHA1

b528651971ac466807350ce24728d76fb6cd0e1a
SHA256

52b6f57b2e7a9fc832227cc0ae02794e506358a295dadcf75387755a1b84b1ea
SHA512

628c3827272e6639008d20c580fb5c7cf6097424b5a55996f588c5c375a79b80684e6c2b783e4161193a53f10d6ae5a84ca81cf30339301ff55e8b289b13f6ba

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Targets

- Target
  
  52b6f57b2e7a9fc832227cc0ae02794e506358a295dadcf75387755a1b84b1ea
- Size
  
  449KB
- MD5
  
  8a488db081cc65579bf9f2f0e7e402d4
- SHA1
  
  b528651971ac466807350ce24728d76fb6cd0e1a
- SHA256
  
  52b6f57b2e7a9fc832227cc0ae02794e506358a295dadcf75387755a1b84b1ea
- SHA512
  
  628c3827272e6639008d20c580fb5c7cf6097424b5a55996f588c5c375a79b80684e6c2b783e4161193a53f10d6ae5a84ca81cf30339301ff55e8b289b13f6ba
Score

10^/10

darkcomet persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometpersistencerattrojan

behavioral2

darkcometpersistencerattrojan