darkcomet | c0c9436da85defdeef4061fdb693bef1f3f5626735a1ec4aa0a6dbefb3ee3b01 | Triage

Sharing

General

Target

c0c9436da85defdeef4061fdb693bef1f3f5626735a1ec4aa0a6dbefb3ee3b01
Size

1.3MB
Sample

221203-gk4efadg2s
MD5

343484d86828c3b14878e28ea740e11f
SHA1

3e5437fa1399cd137ab421f4b1fa2769e45a2365
SHA256

c0c9436da85defdeef4061fdb693bef1f3f5626735a1ec4aa0a6dbefb3ee3b01
SHA512

036a05982222b95e15b876e45ac6c34419b921508a97d7c7e17e1ea0468d2abd2f3952bd673e290b7c7d43c11968296f1f203c6a4cfdaaac50473d024c1b4b41
SSDEEP

24576:sWUwXMG/GK2U+42gLqWzgFXzbRXKnc+cDGjZmvM:7dcG/b7qWCbRXKncR+mU

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Targets

- Target
  
  c0c9436da85defdeef4061fdb693bef1f3f5626735a1ec4aa0a6dbefb3ee3b01
- Size
  
  1.3MB
- MD5
  
  343484d86828c3b14878e28ea740e11f
- SHA1
  
  3e5437fa1399cd137ab421f4b1fa2769e45a2365
- SHA256
  
  c0c9436da85defdeef4061fdb693bef1f3f5626735a1ec4aa0a6dbefb3ee3b01
- SHA512
  
  036a05982222b95e15b876e45ac6c34419b921508a97d7c7e17e1ea0468d2abd2f3952bd673e290b7c7d43c11968296f1f203c6a4cfdaaac50473d024c1b4b41
- SSDEEP
  
  24576:sWUwXMG/GK2U+42gLqWzgFXzbRXKnc+cDGjZmvM:7dcG/b7qWCbRXKncR+mU
Score

10^/10

darkcomet persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Scripting

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

darkcometpersistencerattrojan

behavioral2

darkcometpersistencerattrojan