darkcomet | 8cb7b1f28da387aa0a88d4b3b4005a6497dbd244b730b8d6f0ef78e882bc6a34 | Triage

Sharing

General

Target

000406bb03366b4744852f4bac0f383c_JaffaCakes118
Size

636KB
Sample

240619-xcx6fs1dkj
MD5

000406bb03366b4744852f4bac0f383c
SHA1

ad761bf48d747d4293d24ad43a621f526b0906b3
SHA256

8cb7b1f28da387aa0a88d4b3b4005a6497dbd244b730b8d6f0ef78e882bc6a34
SHA512

1aa215cfa5b8324e18958234dc9364fc866b114ff35a11f7f65608bd495845f8ce137b8847a318ce9269e9c0a4bea0aad900df7ef097b47fed44fed02d92b8f4
SSDEEP

12288:/pwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/t:xwAcu99lPzvxP+Bsz2XjWTRMQckkIXnF

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Targets

- Target
  
  000406bb03366b4744852f4bac0f383c_JaffaCakes118
- Size
  
  636KB
- MD5
  
  000406bb03366b4744852f4bac0f383c
- SHA1
  
  ad761bf48d747d4293d24ad43a621f526b0906b3
- SHA256
  
  8cb7b1f28da387aa0a88d4b3b4005a6497dbd244b730b8d6f0ef78e882bc6a34
- SHA512
  
  1aa215cfa5b8324e18958234dc9364fc866b114ff35a11f7f65608bd495845f8ce137b8847a318ce9269e9c0a4bea0aad900df7ef097b47fed44fed02d92b8f4
- SSDEEP
  
  12288:/pwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/t:xwAcu99lPzvxP+Bsz2XjWTRMQckkIXnF
Score

10^/10

darkcomet evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometevasionpersistencerattrojan

behavioral2

darkcometevasionpersistencerattrojan