darkcomet | 95554e8e6edc65860feed3b2976ac5e6d6e71ef28034449df8e536e775f10ca5 | Triage

Sharing

General

Target

363ccdf350127f4e09240812b7f8a4aa_JaffaCakes118
Size

734KB
Sample

241011-w875vsxbrb
MD5

363ccdf350127f4e09240812b7f8a4aa
SHA1

c8f6ba9604fefb453e16bf3a696c306c3c420f2d
SHA256

95554e8e6edc65860feed3b2976ac5e6d6e71ef28034449df8e536e775f10ca5
SHA512

643dfd3f1af1936980c4595ea11ceae5eba2bb4ab604c504aead7b446b03b6203f99f05df1f999980120247008db91cbc3194dfdd31e2a669db6b2e1fc44e2b1
SSDEEP

12288:JaXTluCLVHtas59KjOGquDN6cDrdUdSZbcrqSeV5J9otAEPL:4XxbJN39KaGt9DxU0ZbcWj9oiA

Score

10^/10

darkcomet hawkeye discovery keylogger persistence rat spyware stealer trojan

Malware Config

Targets

- Target
  
  363ccdf350127f4e09240812b7f8a4aa_JaffaCakes118
- Size
  
  734KB
- MD5
  
  363ccdf350127f4e09240812b7f8a4aa
- SHA1
  
  c8f6ba9604fefb453e16bf3a696c306c3c420f2d
- SHA256
  
  95554e8e6edc65860feed3b2976ac5e6d6e71ef28034449df8e536e775f10ca5
- SHA512
  
  643dfd3f1af1936980c4595ea11ceae5eba2bb4ab604c504aead7b446b03b6203f99f05df1f999980120247008db91cbc3194dfdd31e2a669db6b2e1fc44e2b1
- SSDEEP
  
  12288:JaXTluCLVHtas59KjOGquDN6cDrdUdSZbcrqSeV5J9otAEPL:4XxbJN39KaGt9DxU0ZbcWj9oiA
Score

10^/10

darkcomet hawkeye discovery keylogger persistence rat spyware stealer trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcomethawkeyediscoverykeyloggerpersistenceratspywarestealertrojan

behavioral2

darkcomethawkeyediscoverykeyloggerpersistenceratspywarestealertrojan