darkcomet | fde5d7ff378a963efb1f7a43e6f92a4eba3442e56f8042a7fc428e128866e59d | Triage

Submit
Reports

Overview

overview

Static

static

3

fdea3787ce...18.exe

windows7-x64

fdea3787ce...18.exe

windows10-2004-x64

Sharing

General

Target

fdea3787ce63bebc5ded1b8124005bfb_JaffaCakes118
Size

644KB
Sample

240420-3l7n5sda43
MD5

fdea3787ce63bebc5ded1b8124005bfb
SHA1

55be10e8a4452f2a2856775ed06caa1721c576f9
SHA256

fde5d7ff378a963efb1f7a43e6f92a4eba3442e56f8042a7fc428e128866e59d
SHA512

d344da2dcf1f31bdb4369fb6f2d3f099bd08afe923e51b6d8c377c662efafd3292b374370ea136db841cf4dec49990ab5963ec7d8e1a8c27025933ac715ae7b3
SSDEEP

12288:FXWw5rArh3i/5hzJTIuN7w92L7FAQB+4H6IKZDIZ:F/5eyPrFfi54HQDE

Score

10^/10

darkcomet evasion rat trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fdea3787ce63bebc5ded1b8124005bfb_JaffaCakes118.exe

Resource

win7-20240221-en

darkcomet evasion rat trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

fdea3787ce63bebc5ded1b8124005bfb_JaffaCakes118.exe

Resource

win10v2004-20240412-en

darkcomet evasion rat trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  fdea3787ce63bebc5ded1b8124005bfb_JaffaCakes118
- Size
  
  644KB
- MD5
  
  fdea3787ce63bebc5ded1b8124005bfb
- SHA1
  
  55be10e8a4452f2a2856775ed06caa1721c576f9
- SHA256
  
  fde5d7ff378a963efb1f7a43e6f92a4eba3442e56f8042a7fc428e128866e59d
- SHA512
  
  d344da2dcf1f31bdb4369fb6f2d3f099bd08afe923e51b6d8c377c662efafd3292b374370ea136db841cf4dec49990ab5963ec7d8e1a8c27025933ac715ae7b3
- SSDEEP
  
  12288:FXWw5rArh3i/5hzJTIuN7w92L7FAQB+4H6IKZDIZ:F/5eyPrFfi54HQDE
Score

10^/10

darkcomet evasion rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Disables Task Manager via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionrattrojan

behavioral2

darkcometevasionrattrojan

© 2018-2024

Terms | Privacy