darkcomet

General

Target
3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d
Size 1.5MB
Sample201109-pvvy6vpvae
SHA256 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d
MD5 a8d87f85abebd106b6c3fc3a340931c5
SHA1 b35b4b1c4a9c4729f021a1c7fbdeb1909eb5d84d
SHA512 7d3b846b3481f31072c198e90c80f8957a4dd67834a125da12e21198bc58823e0da5e5114404c783bd7cae642ee31c187571fa1a1c337633219a91d249aade01
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

Runescape

C2

mrsnickers03.no-ip.biz:340

Mutex

DC_MUTEX-6ZFK11A

Attributes

gencode
uNwew4gojxtu
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d
- Size 1.5MB
- SHA256 3a33bcbef59011becd7de5bcc3f0cea7bd19ad899c536ea483aa22ca081a135d
- MD5 a8d87f85abebd106b6c3fc3a340931c5
- SHA1 b35b4b1c4a9c4729f021a1c7fbdeb1909eb5d84d
- SHA512 7d3b846b3481f31072c198e90c80f8957a4dd67834a125da12e21198bc58823e0da5e5114404c783bd7cae642ee31c187571fa1a1c337633219a91d249aade01
- MD5 SHA1 SHA512
Score

10^/10

darkcomet runescape rat trojan upx persistence
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2