darkcomet | 71b0096170ce81b22f524bc51d6b2ca9005ccd7d2ffbed84bc5e4e16f45f08fb | Triage

Sharing

General

Target

6920330200e785b2f1047e8545e8ff8b_JaffaCakes118
Size

658KB
Sample

240523-an9masee8z
MD5

6920330200e785b2f1047e8545e8ff8b
SHA1

8d1c5cc709216069ee5a5269eaf2b8c233cbcc38
SHA256

71b0096170ce81b22f524bc51d6b2ca9005ccd7d2ffbed84bc5e4e16f45f08fb
SHA512

65a7f608e667781903ede00aa9e2bf93304cfa58d6f0b39b62d28835d619d41a42871cd6ccc3d5fb2c4b6fffadcda931ca214225af14a941b26eeeec459b20e7
SSDEEP

12288:C9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hr:uZ1xuVVjfFoynPaVBUR8f+kN10EB9

Score

10^/10

darkcomet msupdateg20 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

msupdateg20

C2

mscert.strangled.net:80

Mutex

DC_MUTEX-SRS59XN

Attributes

gencode
llfLUVwuT7Lb
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  
  6920330200e785b2f1047e8545e8ff8b_JaffaCakes118
- Size
  
  658KB
- MD5
  
  6920330200e785b2f1047e8545e8ff8b
- SHA1
  
  8d1c5cc709216069ee5a5269eaf2b8c233cbcc38
- SHA256
  
  71b0096170ce81b22f524bc51d6b2ca9005ccd7d2ffbed84bc5e4e16f45f08fb
- SHA512
  
  65a7f608e667781903ede00aa9e2bf93304cfa58d6f0b39b62d28835d619d41a42871cd6ccc3d5fb2c4b6fffadcda931ca214225af14a941b26eeeec459b20e7
- SSDEEP
  
  12288:C9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hr:uZ1xuVVjfFoynPaVBUR8f+kN10EB9
Score

10^/10

darkcomet msupdateg20 rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

msupdateg20darkcomet

behavioral1

darkcometmsupdateg20rattrojan

behavioral2

darkcometmsupdateg20rattrojan