darkcomet | 27e0943845dcfa97ebc467aa534369b6993bee9ebd4a0779e04c29b7b3a7bdcd | Triage

Submit
Reports

Overview

overview

Static

static

27e0943845...cd.exe

windows7-x64

27e0943845...cd.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

27e0943845dcfa97ebc467aa534369b6993bee9ebd4a0779e04c29b7b3a7bdcd
Size

337KB
Sample

221003-trpk3sedeq
MD5

6eafe11f4cbe8a8ffd829d49c3b94c1b
SHA1

50598c40beab243eeb0921023357a3ffb9e929fc
SHA256

27e0943845dcfa97ebc467aa534369b6993bee9ebd4a0779e04c29b7b3a7bdcd
SHA512

da04039b4be99e5b841efb03eb2431a2c04e3023c66cdbb71c7a0aafd50403975d0da22a7fbc189fe1c75633df787869d0c80a2e40f93e78cf360b05bba3d7d5
SSDEEP

6144:zUc8SY8u+rv6Kl9QFhC6z3sbS4P2UI9icyXV13kPKuzGnVAjRZLLeMdWnpQZh9h4:zUcrY8driIQHG2D1axkPKdSIMd0QZh9u

Score

10^/10

darkcomet evasion rat trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

27e0943845dcfa97ebc467aa534369b6993bee9ebd4a0779e04c29b7b3a7bdcd.exe

Resource

win7-20220812-en

darkcomet evasion rat trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

27e0943845dcfa97ebc467aa534369b6993bee9ebd4a0779e04c29b7b3a7bdcd.exe

Resource

win10v2004-20220901-en

darkcomet evasion rat trojan upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  27e0943845dcfa97ebc467aa534369b6993bee9ebd4a0779e04c29b7b3a7bdcd
- Size
  
  337KB
- MD5
  
  6eafe11f4cbe8a8ffd829d49c3b94c1b
- SHA1
  
  50598c40beab243eeb0921023357a3ffb9e929fc
- SHA256
  
  27e0943845dcfa97ebc467aa534369b6993bee9ebd4a0779e04c29b7b3a7bdcd
- SHA512
  
  da04039b4be99e5b841efb03eb2431a2c04e3023c66cdbb71c7a0aafd50403975d0da22a7fbc189fe1c75633df787869d0c80a2e40f93e78cf360b05bba3d7d5
- SSDEEP
  
  6144:zUc8SY8u+rv6Kl9QFhC6z3sbS4P2UI9icyXV13kPKuzGnVAjRZLLeMdWnpQZh9h4:zUcrY8driIQHG2D1axkPKdSIMd0QZh9u
Score

10^/10

darkcomet evasion rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionrattrojanupx

behavioral2

darkcometevasionrattrojanupx

© 2018-2025

Terms | Privacy