darkcomet

General

Target

c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
Size

317KB
Sample

221203-cgy84ahe5v
MD5

178b94a462503845831cd0a6c3e3b500
SHA1

99510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256

c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512

ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
SSDEEP

6144:hzjAH9agPC3gLzeAyzhsv70s3QS8A7KQGNBZmUF4nHytzcc:xAdag1mAyzMxp8A7KQGNBZm3HOcc

Score

10^/10

darkcomet 24 evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

24

C2

127.0.0.1:1604

172.162.22.200:1604

remaxcheckings.no-ip.biz:1604

Mutex

DC_MUTEX-AT9WGLV

Attributes

InstallPath
MSDCSC\remaxcheckings.exe
gencode
WN5Nr6wiGseC
install
true
offline_keylogger
true
persistence
true
reg_key
remaxcheckings

Targets

- Target
  
  c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
- Size
  
  317KB
- MD5
  
  178b94a462503845831cd0a6c3e3b500
- SHA1
  
  99510e9b7abbfff7cc4097e51196ad801fc1d82d
- SHA256
  
  c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
- SHA512
  
  ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
- SSDEEP
  
  6144:hzjAH9agPC3gLzeAyzhsv70s3QS8A7KQGNBZmUF4nHytzcc:xAdag1mAyzMxp8A7KQGNBZm3HOcc
Score

10^/10

darkcomet 24 evasion persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2