darkcomet | ea13326b575938d44c5e1519b939e26b693437c97a38b6467d009dfdbe356918 | Triage

Submit
Reports

Overview

overview

Static

static

5

3ab3ebf657...18.exe

windows7-x64

3ab3ebf657...18.exe

windows10-2004-x64

Sharing

General

Target

3ab3ebf6573f388f319d796e4291227f_JaffaCakes118
Size

748KB
Sample

241012-slz9ys1epk
MD5

3ab3ebf6573f388f319d796e4291227f
SHA1

ff4103e3e6beb28dd3c5a5b75ff74c197768891d
SHA256

ea13326b575938d44c5e1519b939e26b693437c97a38b6467d009dfdbe356918
SHA512

f5770fdba962d4566340b3b078d0fefa7b9dfbfda221037808eb20228f512d6589e06f5ca3207d819660eca4187e528955b6b89f31000d4c9ddd84fc124f4947
SSDEEP

12288:2p17EOUIRmUqW8P84NiYEbThZaX1EoqKU8sMSwzI7XK2Z2AG6vHOrXz4ltx4FdiY:E8amUq7P84cYEbdoEoM8sEzI7XKTAG6u

Score

10^/10

darkcomet discovery rat trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

3ab3ebf6573f388f319d796e4291227f_JaffaCakes118.exe

Resource

win7-20240903-en

darkcomet discovery rat trojan upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

3ab3ebf6573f388f319d796e4291227f_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery rat trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  3ab3ebf6573f388f319d796e4291227f_JaffaCakes118
- Size
  
  748KB
- MD5
  
  3ab3ebf6573f388f319d796e4291227f
- SHA1
  
  ff4103e3e6beb28dd3c5a5b75ff74c197768891d
- SHA256
  
  ea13326b575938d44c5e1519b939e26b693437c97a38b6467d009dfdbe356918
- SHA512
  
  f5770fdba962d4566340b3b078d0fefa7b9dfbfda221037808eb20228f512d6589e06f5ca3207d819660eca4187e528955b6b89f31000d4c9ddd84fc124f4947
- SSDEEP
  
  12288:2p17EOUIRmUqW8P84NiYEbThZaX1EoqKU8sMSwzI7XK2Z2AG6vHOrXz4ltx4FdiY:E8amUq7P84cYEbdoEoM8sEzI7XKTAG6u
Score

10^/10

darkcomet discovery rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryrattrojanupx

behavioral2

darkcometdiscoveryrattrojanupx

© 2018-2025

Terms | Privacy