darkcomet | cc00f80a830956c5c1344742e632c9f057b283ded101dc0dd4fd9a7ea95d4017 | Triage

Submit
Reports

Overview

overview

Static

static

3f81868631...18.exe

windows10-1703-x64

3f81868631...18.exe

windows11-21h2-x64

Sharing

General

Target

3f8186863141e36ce609292a3da36e83_JaffaCakes118
Size

233KB
Sample

241013-ne7cgatdnf
MD5

3f8186863141e36ce609292a3da36e83
SHA1

ed7d9833ec8ade66607286a79e2a10515f9f7625
SHA256

cc00f80a830956c5c1344742e632c9f057b283ded101dc0dd4fd9a7ea95d4017
SHA512

9050e6b0df8a4752d978288f809b992c6ff8eb5c6157b64a4776a040cdcb7a25068bc6425de5cd93e910826fce24d80416474f80f6acf8583339a7daf34016bc
SSDEEP

6144:/4CFfifD2gVKVTQQ249HZ52KTh9XKOCgLJacj5/AZtRs:/Xgr8VMQDT52WXKq9fj5/AZj

Score

10^/10

darkcomet discovery evasion persistence rat trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

3f8186863141e36ce609292a3da36e83_JaffaCakes118.exe

Resource

win10-20240404-en

darkcomet discovery evasion persistence rat trojan upx

windows10-1703-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

3f8186863141e36ce609292a3da36e83_JaffaCakes118.exe

Resource

win11-20241007-en

darkcomet discovery evasion persistence rat trojan upx

windows11-21h2-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  3f8186863141e36ce609292a3da36e83_JaffaCakes118
- Size
  
  233KB
- MD5
  
  3f8186863141e36ce609292a3da36e83
- SHA1
  
  ed7d9833ec8ade66607286a79e2a10515f9f7625
- SHA256
  
  cc00f80a830956c5c1344742e632c9f057b283ded101dc0dd4fd9a7ea95d4017
- SHA512
  
  9050e6b0df8a4752d978288f809b992c6ff8eb5c6157b64a4776a040cdcb7a25068bc6425de5cd93e910826fce24d80416474f80f6acf8583339a7daf34016bc
- SSDEEP
  
  6144:/4CFfifD2gVKVTQQ249HZ52KTh9XKOCgLJacj5/AZtRs:/Xgr8VMQDT52WXKq9fj5/AZj
Score

10^/10

darkcomet discovery evasion persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoveryevasionpersistencerattrojanupx

behavioral2

darkcometdiscoveryevasionpersistencerattrojanupx

© 2018-2025

Terms | Privacy