darkcomet | c3cb482354de39729819493ab1f9c369d51be690f18dac97fe89bb2c2ed7bb49 | Triage

Submit
Reports

Overview

overview

Static

static

7

524ca2f4cd...18.exe

windows7-x64

524ca2f4cd...18.exe

windows10-2004-x64

Sharing

General

Target

524ca2f4cdccb301b31c60c7fba9e3af_JaffaCakes118
Size

500KB
Sample

241017-rbbceazfpb
MD5

524ca2f4cdccb301b31c60c7fba9e3af
SHA1

9789b76c29dcec00f922b531a3d40ea31f1954e9
SHA256

c3cb482354de39729819493ab1f9c369d51be690f18dac97fe89bb2c2ed7bb49
SHA512

cc7259ba7cfec9c5e7177f787619b459381fb1a98160dd6bd2cbe53f7b5f005b5b0bb9073131b8435879fba740468ef8552f8af26606f1e37dcddffbf628ef17
SSDEEP

12288:0RFj60lHJFHN5qA9PASqB6CSCR49913oDC:fSNgA91HRH913oDC

Score

10^/10

darkcomet discovery persistence rat trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

524ca2f4cdccb301b31c60c7fba9e3af_JaffaCakes118.exe

Resource

win7-20240729-en

darkcomet discovery persistence rat trojan upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

524ca2f4cdccb301b31c60c7fba9e3af_JaffaCakes118.exe

Resource

win10v2004-20241007-en

darkcomet discovery persistence rat trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  524ca2f4cdccb301b31c60c7fba9e3af_JaffaCakes118
- Size
  
  500KB
- MD5
  
  524ca2f4cdccb301b31c60c7fba9e3af
- SHA1
  
  9789b76c29dcec00f922b531a3d40ea31f1954e9
- SHA256
  
  c3cb482354de39729819493ab1f9c369d51be690f18dac97fe89bb2c2ed7bb49
- SHA512
  
  cc7259ba7cfec9c5e7177f787619b459381fb1a98160dd6bd2cbe53f7b5f005b5b0bb9073131b8435879fba740468ef8552f8af26606f1e37dcddffbf628ef17
- SSDEEP
  
  12288:0RFj60lHJFHN5qA9PASqB6CSCR49913oDC:fSNgA91HRH913oDC
Score

10^/10

darkcomet discovery persistence rat trojan upx
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- Modifies WinLogon for persistence
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Molebox Virtualization software
  Detects file using Molebox Virtualization software.
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkcometdiscoverypersistencerattrojanupx

behavioral2

darkcometdiscoverypersistencerattrojanupx

© 2018-2024

Terms | Privacy