darkcomet

General

Target

c2bc9d90cf7c07e8a7fbf0e95ee6f2f498bf7013af1244b56bbec2710a62447c
Size

986KB
Sample

221203-xns1wabc7v
MD5

e4589bdd4373f16a69e4920cbc073027
SHA1

f0ebc47a2aeff4b011b83fc259add79269e9088a
SHA256

c2bc9d90cf7c07e8a7fbf0e95ee6f2f498bf7013af1244b56bbec2710a62447c
SHA512

1df8da02951c320883ce91c5bf2ba562ebfee8cd8b7b620f7654c8f6d9d1a5ce1d7f8118de2cf766ce452803db0df13a6ee270f393e0237b0c610565a1e34442
SSDEEP

12288:iaAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuN9oSd:zAEE3uBDhynCylQgi63O9+VuNt

Score

10^/10

Malware Config

Targets

- Target
  
  c2bc9d90cf7c07e8a7fbf0e95ee6f2f498bf7013af1244b56bbec2710a62447c
- Size
  
  986KB
- MD5
  
  e4589bdd4373f16a69e4920cbc073027
- SHA1
  
  f0ebc47a2aeff4b011b83fc259add79269e9088a
- SHA256
  
  c2bc9d90cf7c07e8a7fbf0e95ee6f2f498bf7013af1244b56bbec2710a62447c
- SHA512
  
  1df8da02951c320883ce91c5bf2ba562ebfee8cd8b7b620f7654c8f6d9d1a5ce1d7f8118de2cf766ce452803db0df13a6ee270f393e0237b0c610565a1e34442
- SSDEEP
  
  12288:iaAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuN9oSd:zAEE3uBDhynCylQgi63O9+VuNt
Score

10^/10

darkcomet evasion persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2