darkcomet | ddf9e079a76de8dd5a5002f8c5f9e9737172f92563f976b46ea8674979558e0f | Triage

Sharing

General

Target

f90de3936e5c2612ca543abe23d97126_JaffaCakes118
Size

660KB
Sample

240419-ad7pysbg6t
MD5

f90de3936e5c2612ca543abe23d97126
SHA1

2df894ae42a5b72f7edb9380d866683faf0c6bc7
SHA256

ddf9e079a76de8dd5a5002f8c5f9e9737172f92563f976b46ea8674979558e0f
SHA512

5347a327d0b0d35116b2a47d3a4100ad36b849c7c61f7ce2aae26f45ffc16ed0ddce4bd8dcea9f7ffad8dfa847b742aa0579a1a84706c4a1e38d5a74d304752d
SSDEEP

12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uf:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4JP

Score

10^/10

darkcomet rsaccs rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

rsaccs

C2

184.146.144.115:4001

192.168.2.2:4001

Mutex

DC_MUTEX-BPZWXH2

Attributes

gencode
f7uRNmtQGXRm
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  
  f90de3936e5c2612ca543abe23d97126_JaffaCakes118
- Size
  
  660KB
- MD5
  
  f90de3936e5c2612ca543abe23d97126
- SHA1
  
  2df894ae42a5b72f7edb9380d866683faf0c6bc7
- SHA256
  
  ddf9e079a76de8dd5a5002f8c5f9e9737172f92563f976b46ea8674979558e0f
- SHA512
  
  5347a327d0b0d35116b2a47d3a4100ad36b849c7c61f7ce2aae26f45ffc16ed0ddce4bd8dcea9f7ffad8dfa847b742aa0579a1a84706c4a1e38d5a74d304752d
- SSDEEP
  
  12288:QXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uf:2nAw2WWeFcfbP9VPSPMTSPL/rWvzq4JP
Score

10^/10

darkcomet rsaccs rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

rsaccsdarkcomet

behavioral1

darkcometrsaccsrattrojan

behavioral2

darkcometrsaccsrattrojan