darkcomet | 4f31add14bedd14e61273d595800009c3734abf255cebfdb4aeee7f5f0de9995 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

8ae604c95a...18.exe

windows7-x64

8ae604c95a...18.exe

windows10-2004-x64

Sharing

General

Target

8ae604c95a1954b070729d8321c3a00d_JaffaCakes118
Size

617KB
Sample

240811-stvz7szclc
MD5

8ae604c95a1954b070729d8321c3a00d
SHA1

9c90fa460cc5f48ceedbe0ec6c8d3a004b476f66
SHA256

4f31add14bedd14e61273d595800009c3734abf255cebfdb4aeee7f5f0de9995
SHA512

618197aa89a3af21324d62382690ba6b03b8b27f39d55bf30bf3721e59ae7baa63e1bbbd4460c67317b4369442114adf53223ca025f6a7e6952c73ed2da493dc
SSDEEP

12288:1pwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIX:HwAcu99lPzvxP+Bsz2XjWTRMQckkIX

Score

10^/10

darkcomet discovery persistence rat trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

8ae604c95a1954b070729d8321c3a00d_JaffaCakes118.exe

Resource

win7-20240704-en

darkcomet discovery persistence rat trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

8ae604c95a1954b070729d8321c3a00d_JaffaCakes118.exe

Resource

win10v2004-20240802-en

darkcomet discovery persistence rat trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  8ae604c95a1954b070729d8321c3a00d_JaffaCakes118
- Size
  
  617KB
- MD5
  
  8ae604c95a1954b070729d8321c3a00d
- SHA1
  
  9c90fa460cc5f48ceedbe0ec6c8d3a004b476f66
- SHA256
  
  4f31add14bedd14e61273d595800009c3734abf255cebfdb4aeee7f5f0de9995
- SHA512
  
  618197aa89a3af21324d62382690ba6b03b8b27f39d55bf30bf3721e59ae7baa63e1bbbd4460c67317b4369442114adf53223ca025f6a7e6952c73ed2da493dc
- SSDEEP
  
  12288:1pwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIX:HwAcu99lPzvxP+Bsz2XjWTRMQckkIX
Score

10^/10

darkcomet discovery persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojan

behavioral2

darkcometdiscoverypersistencerattrojan

© 2018-2025

Terms | Privacy