darkcomet | d4936b03e9af415c62c3487314b659c35ebff2dfd248ebe24f3a73ee0bcc6379 | Triage

Sharing

General

Target

4874e617d68183863cf122f64370fe00_JaffaCakes118
Size

1.3MB
Sample

241015-sb6nzsvdkl
MD5

4874e617d68183863cf122f64370fe00
SHA1

e7af240418e654da9a2a8ecf7bdffc023f09a121
SHA256

d4936b03e9af415c62c3487314b659c35ebff2dfd248ebe24f3a73ee0bcc6379
SHA512

053b31e997c6db01329d07fe579479b4a47241137b5937ce469783ccb0681f279d58cfa05d1e1993f70cee8372b1e45292ced1a8724485eee86612b44dd11a5d
SSDEEP

24576:iRmYkcoQricOIrxiZY1iaCvHp7wKaHnCMjORymu7Xmg7FT2bL:3YZoQrbT8ZY1iaC/p16zt2g7FaP

Score

10^/10

darkcomet newids discovery evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

NewIDs

C2

fvckthesyst3m.no-ip.org:1604

Mutex

DC_MUTEX-JGWKK3L

Attributes

gencode
hc8JG7lbWhDC
install
false
offline_keylogger
true
persistence
false

Targets

- Target
  
  4874e617d68183863cf122f64370fe00_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  4874e617d68183863cf122f64370fe00
- SHA1
  
  e7af240418e654da9a2a8ecf7bdffc023f09a121
- SHA256
  
  d4936b03e9af415c62c3487314b659c35ebff2dfd248ebe24f3a73ee0bcc6379
- SHA512
  
  053b31e997c6db01329d07fe579479b4a47241137b5937ce469783ccb0681f279d58cfa05d1e1993f70cee8372b1e45292ced1a8724485eee86612b44dd11a5d
- SSDEEP
  
  24576:iRmYkcoQricOIrxiZY1iaCvHp7wKaHnCMjORymu7Xmg7FT2bL:3YZoQrbT8ZY1iaC/p16zt2g7FaP
Score

10^/10

darkcomet newids discovery evasion persistence rat trojan
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometnewidsdiscoveryevasionpersistencerattrojan

behavioral2

darkcometnewidsdiscoveryevasionpersistencerattrojan