darkcomet | 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca | Triage

Submit
Reports

Overview

overview

Static

static

23c1125192...ca.exe

windows7-x64

23c1125192...ca.exe

windows10-2004-x64

Sharing

General

Target

23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca
Size

647KB
Sample

221020-bharfsgac3
MD5

82d7fb6f8eac4e9de4b56956763f3e20
SHA1

bcae4eb9f4d54b10935a943a0d2edf404a1f062e
SHA256

23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca
SHA512

0c413294befd737df17712aa66e441b478cf4b96629ac267d3dd2c4ffce567abcc86f09992e3eeda13fb554af27a73e1063a6c67215341675efd2d45308583bd
SSDEEP

12288:Q8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixD:JUKoN0bUxgGa/pfBHDb+y1HgZZ

Score

10^/10

darkcomet evasion persistence rat trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe

Resource

win7-20220812-en

darkcomet evasion persistence rat trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe

Resource

win10v2004-20220812-en

darkcomet evasion persistence rat trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca
- Size
  
  647KB
- MD5
  
  82d7fb6f8eac4e9de4b56956763f3e20
- SHA1
  
  bcae4eb9f4d54b10935a943a0d2edf404a1f062e
- SHA256
  
  23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca
- SHA512
  
  0c413294befd737df17712aa66e441b478cf4b96629ac267d3dd2c4ffce567abcc86f09992e3eeda13fb554af27a73e1063a6c67215341675efd2d45308583bd
- SSDEEP
  
  12288:Q8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixD:JUKoN0bUxgGa/pfBHDb+y1HgZZ
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan

© 2018-2025

Terms | Privacy