darkcomet | d678659ae27cccb968254b6697cf4f2dc2da9f789a6cc1a7d9b8e0ff8beadd1c | Triage

Sharing

General

Target

ffbd76b0e495188604e247095f09c98d_JaffaCakes118
Size

756KB
Sample

240421-vd1a4afe27
MD5

ffbd76b0e495188604e247095f09c98d
SHA1

f6f9e1443990eb4bc18d520ae419abc4304fcd33
SHA256

d678659ae27cccb968254b6697cf4f2dc2da9f789a6cc1a7d9b8e0ff8beadd1c
SHA512

7fd0b3c9685180c3a3daf28d930591607ee4ab949aee296ea8311f490102bc8c7f67a7586e1adf0bb44ce5a778dafbbca62fd031a231917b2cb6fbeeca85e2b9
SSDEEP

12288:F9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKW:jAQ6Zx9cxTmOrucTIEFSpOGl

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  ffbd76b0e495188604e247095f09c98d_JaffaCakes118
- Size
  
  756KB
- MD5
  
  ffbd76b0e495188604e247095f09c98d
- SHA1
  
  f6f9e1443990eb4bc18d520ae419abc4304fcd33
- SHA256
  
  d678659ae27cccb968254b6697cf4f2dc2da9f789a6cc1a7d9b8e0ff8beadd1c
- SHA512
  
  7fd0b3c9685180c3a3daf28d930591607ee4ab949aee296ea8311f490102bc8c7f67a7586e1adf0bb44ce5a778dafbbca62fd031a231917b2cb6fbeeca85e2b9
- SSDEEP
  
  12288:F9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKW:jAQ6Zx9cxTmOrucTIEFSpOGl
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan