darkcomet

General

Target
297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
Size 381KB
Sample221011-ea1jpadcfr
SHA256 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
MD5 546c072b018550f4d7d0906a680fd3c0
SHA1 7dd5804dc559699abc96d006c05579eed1f85abe
SHA512 789263c911a0eb94de1125e3cb441476f25eb619d5d966781371e98695a523016c59766252cdd681f8f7bc085894a86213090a89ebf4dd6ef5a324db44fd5b57
SSDEEP 6144:+sf/8tS6zpoyWktBnmYAlcw0hvd96/LM69hMNyJwOm:+sX8AYFTtBmYKcD196/oySNyqOm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet cc persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

CC

C2

212.7.192.244:1337

Mutex

DC_MUTEX-8DTXF5E

Attributes

gencode
lN8zNVYPTGKV
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
- Size 381KB
- SHA256 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
- MD5 546c072b018550f4d7d0906a680fd3c0
- SHA1 7dd5804dc559699abc96d006c05579eed1f85abe
- SHA512 789263c911a0eb94de1125e3cb441476f25eb619d5d966781371e98695a523016c59766252cdd681f8f7bc085894a86213090a89ebf4dd6ef5a324db44fd5b57
- SSDEEP 6144:+sf/8tS6zpoyWktBnmYAlcw0hvd96/LM69hMNyJwOm:+sX8AYFTtBmYKcD196/oySNyqOm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

darkcomet cc persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2